set fake_rtable's dst to NULL to avoid kernel Oops

PATCH Applied Peter Huang(Peng) 2 participants 2 messages Apr 20, 2012 – Apr 24, 2012

Subsystems (4)

Networking Network drivers netfilter Ethernet bridge

lore

Share & tools

lore

Peter Huang(Peng)

author

2012-04-20 06:13 UTC #0 lore raw

PATCH v4 1/1 set fake_rtable's dst to NULL to avoid kernel Oops

bridge: set fake_rtable's dst to NULL to avoid kernel Oops

when bridge is deleted before tap/vif device's delete, kernel may encounter an oops because of NULL reference to fake_rtable's dst. Set fake_rtable's dst to NULL before sending packets out can solve this problem.

v4 reformat, change br_drop_fake_rtable(skb) to {}

v3 enrich commit header

v2 introducing new flag DST_FAKE_RTABLE to dst_entry struct.

Acked-by Eric Dumazet <[email protected]>

Signed-off-by Peter Huang <[email protected]>

---
 include/linux/netfilter_bridge.h |    9 +++++++++
 include/net/dst.h                |    1 +
 net/bridge/br_forward.c          |    1 +
 net/bridge/br_netfilter.c        |    8 ++------
 4 files changed, 13 insertions(+), 6 deletions(-)

include/linux/netfilter_bridge.h +9 -0

index 0ddd161..3da2798 100644
@@ -104,9 +104,18 @@ struct bridge_skb_cb {
 	} daddr;
 };
 
+static inline void br_drop_fake_rtable(struct sk_buff *skb)
+{
+	struct dst_entry *dst = skb_dst(skb);
+
+	if (dst && (dst->flags & DST_FAKE_RTABLE))
+		skb_dst_drop(skb);
+}
+
 #else
 #define nf_bridge_maybe_copy_header(skb)	(0)
 #define nf_bridge_pad(skb)			(0)
+#define br_drop_fake_rtable(skb)	        {}
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */

include/net/dst.h +1 -0

index 59c5d18..b094030 100644
@@ -55,6 +55,7 @@ struct dst_entry {
 #define DST_NOCACHE		0x0010
 #define DST_NOCOUNT		0x0020
 #define DST_NOPEER		0x0040
+#define DST_FAKE_RTABLE		0x0080
 
 	short			error;
 	short			obsolete;

net/bridge/br_forward.c +1 -0

index 61f6534..a2098e3 100644
@@ -47,6 +47,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
 		kfree_skb(skb);
 	} else {
 		skb_push(skb, ETH_HLEN);
+		br_drop_fake_rtable(skb);
 		dev_queue_xmit(skb);
 	}

net/bridge/br_netfilter.c +2 -6

index dec4f38..d7f49b6 100644
@@ -156,7 +156,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
 	rt->dst.dev = br->dev;
 	rt->dst.path = &rt->dst;
 	dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
-	rt->dst.flags	= DST_NOXFRM | DST_NOPEER;
+	rt->dst.flags	= DST_NOXFRM | DST_NOPEER | DST_FAKE_RTABLE;
 	rt->dst.ops = &fake_dst_ops;
 }

@@ -694,11 +694,7 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
 				   const struct net_device *out,
 				   int (*okfn)(struct sk_buff *))
 {
-	struct rtable *rt = skb_rtable(skb);
-
-	if (rt && rt == bridge_parent_rtable(in))
-		skb_dst_drop(skb);
-
+	br_drop_fake_rtable(skb);
 	return NF_ACCEPT;
 }

Signature · 1 line

1.7.1

David Miller

maintainer Applied

2012-04-24 04:18 UTC #1 lore raw

From: "Peter Huang(Peng)" <[email protected]>
Date: Fri, 20 Apr 2012 14:12:51 +0800

Quoted 7 lines

bridge: set fake_rtable's dst to NULL to avoid kernel Oops
when bridge is deleted before tap/vif device's delete, kernel may encounter an oops because of NULL reference to fake_rtable's dst. Set fake_rtable's dst to NULL before sending packets out can solve this problem.

Quoted 8 lines

v4 reformat, change br_drop_fake_rtable(skb) to {}
v3 enrich commit header
v2 introducing new flag DST_FAKE_RTABLE to dst_entry struct.
Acked-by Eric Dumazet <[email protected]>
Signed-off-by Peter Huang <[email protected]>

Applied, although I changed to nop br_drop_fake_rtable() implementation to use "do { } while (0)" instead of just plain "{ }".