Re: [BUG] crashes with kvm/nat networking and net-next

[Stephen Hemminger <shemminger@vyatta.com>]

On Wed, 12 May 2010 16:03:54 +0200
Bart De Schuymer <bdschuym@pandora.be> wrote:

> Patrick McHardy wrote:
> > Eric Dumazet wrote:
> >> Le mardi 11 mai 2010 à 20:25 -0700, Stephen Hemminger a écrit :
> >>> This is a regression that is showing up now in net-next, not sure what
> >>> changed recently in bridge netfilter that could be causing it?
> >>>
> >>> [ 4593.956206] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
> >>> [ 4593.956219] IP: [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge]
> >> Not sure, but br_nf_forward_ip() has following check :
> >>
> >> if (!skb->nf_bridge)
> >> 	return NF_ACCEPT;
> >>
> >> while br_nf_forward_arp() missed this check ...
> >>
> >> So we can dereference null pointer later
> > 
> > That looks correct to me, offset 0x18 would be nf_bridge_info->mask.
> > Bart, please review, thanks.
> > 
> >> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
> >> index 93f80fe..cd2e5f5 100644
> >> --- a/net/bridge/br_netfilter.c
> >> +++ b/net/bridge/br_netfilter.c
> >> @@ -723,6 +723,9 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
> >>  		return NF_ACCEPT;
> >>  #endif
> >>  
> >> +	if (!skb->nf_bridge)
> >> +		return NF_ACCEPT;
> >> +
> >>  	if (skb->protocol != htons(ETH_P_ARP)) {
> >>  		if (!IS_VLAN_ARP(skb))
> >>  			return NF_ACCEPT;
> 
> That won't fix it since nf_bridge isn't used in the ARP case. The
> correct fix is below. Does anyone know why the null pointer
> dereference (skb->nf_bridge->mask & BRNF_8021Q) in
> nf_bridge_update_protocol() didn't cause my uml kernel to crash??
> 
> cheers,
> Bart
> 
> 
> Don't call nf_bridge_update_protocol() for ARP traffic as
> skb->nf_bridge isn't used in the ARP case.
> 
> 
> Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
> Reported-by: Stephen Hemminger <shemminger@vyatta.com>
> 
> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
> index 93f80fe..4442099 100644
> --- a/net/bridge/br_netfilter.c
> +++ b/net/bridge/br_netfilter.c
> @@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb)
>  			skb->pkt_type = PACKET_OTHERHOST;
>  			nf_bridge->mask ^= BRNF_PKT_TYPE;
>  		}
> +		nf_bridge_update_protocol(skb);
>  	} else {
>  		in = *((struct net_device **)(skb->cb));
>  	}
> -	nf_bridge_update_protocol(skb);
>  	nf_bridge_push_encap_header(skb);
>  
>  	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,
> 

This has worked all day for me without problem.


--