random panics in bridging on 2.6.34+

Bug 16572 Applied Herbert Xu 3 participants 3 messages Mar 18, 2011 3 messages not in the archive

Subsystems (4)

Networking Network drivers netfilter Ethernet bridge

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]/

A message that is not in the archive (sent off-list or not yet received): [email protected]

A message that is not in the archive (sent off-list or not yet received): 20110318081052.6ca134fb@nehalam

Herbert Xu

author

2011-03-18 15:27 UTC #3 lore raw

Quoted 6 lines · Stephen Hemminger

Quoted 1 line · On Fri, 18 Mar 2011 13:49:03 GMT [email protected] wrote:
https://bugzilla.kernel.org/show_bug.cgi?id=16572
Herbert hasn't submitted the patch upstream.

Oops! Thanks for reminding me.

bridge: Reset IPCB when entering IP stack on NF_FORWARD

Whenever we enter the IP stack proper from bridge netfilter we need to ensure that the skb is in a form the IP stack expects it to be in.

The entry point on NF_FORWARD did not meet the requirements of the IP stack, therefore leading to potential crashes/panics.

This patch fixes the problem.

Signed-off-by Herbert Xu <[email protected]>

net/bridge/br_netfilter.c +3 -0

index 865fd76..7e9b167 100644
@@ -752,6 +752,9 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
 		nf_bridge->mask |= BRNF_PKT_TYPE;
 	}
 
+	if (br_parse_ip_options(skb))
+		return NF_DROP;
+
 	/* The physdev module checks on this */
 	nf_bridge->mask |= BRNF_BRIDGED;
 	nf_bridge->physoutdev = skb->dev;

Cheers,

Signature · 3 lines

Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Stephen Hemminger

Acked-by

2011-03-18 16:04 UTC #4 lore raw

Quoted 16 lines · On Fri, 18 Mar 2011 10:27:28 -0500 Herbert Xu <[email protected]>…

Quoted 6 lines · Stephen Hemminger
Quoted 1 line · On Fri, 18 Mar 2011 13:49:03 GMT [email protected] wrote:
https://bugzilla.kernel.org/show_bug.cgi?id=16572
Herbert hasn't submitted the patch upstream.
Oops! Thanks for reminding me.
bridge: Reset IPCB when entering IP stack on NF_FORWARD
Whenever we enter the IP stack proper from bridge netfilter we need to ensure that the skb is in a form the IP stack expects it to be in.

Quoted 6 lines

The entry point on NF_FORWARD did not meet the requirements of the IP stack, therefore leading to potential crashes/panics.
This patch fixes the problem.
Signed-off-by Herbert Xu <[email protected]>

Acked-by Stephen Hemminger <[email protected]>

David Miller

maintainer Applied

2011-03-18 22:16 UTC #5 lore raw

From: Stephen Hemminger <[email protected]>
Date: Fri, 18 Mar 2011 09:03:38 -0700

Quoted 19 lines

Quoted 16 lines · On Fri, 18 Mar 2011 10:27:28 -0500 Herbert Xu <[email protected]>…
Quoted 6 lines · Stephen Hemminger
Quoted 1 line · On Fri, 18 Mar 2011 13:49:03 GMT [email protected] wrote:
https://bugzilla.kernel.org/show_bug.cgi?id=16572
Herbert hasn't submitted the patch upstream.
Oops! Thanks for reminding me.
bridge: Reset IPCB when entering IP stack on NF_FORWARD
Whenever we enter the IP stack proper from bridge netfilter we need to ensure that the skb is in a form the IP stack expects it to be in.

Quoted 7 lines

Quoted 6 lines
The entry point on NF_FORWARD did not meet the requirements of the IP stack, therefore leading to potential crashes/panics.
This patch fixes the problem.
Signed-off-by Herbert Xu <[email protected]>
Acked-by Stephen Hemminger <[email protected]>

Applied.