Re: [BUG] crashes with kvm/nat networking and net-next

[Bart De Schuymer <bdschuym@pandora.be>]

Patrick McHardy wrote:
> Eric Dumazet wrote:
>> Le mardi 11 mai 2010 à 20:25 -0700, Stephen Hemminger a écrit :
>>> This is a regression that is showing up now in net-next, not sure what
>>> changed recently in bridge netfilter that could be causing it?
>>>
>>> [ 4593.956206] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
>>> [ 4593.956219] IP: [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge]
>> Not sure, but br_nf_forward_ip() has following check :
>>
>> if (!skb->nf_bridge)
>> 	return NF_ACCEPT;
>>
>> while br_nf_forward_arp() missed this check ...
>>
>> So we can dereference null pointer later
> 
> That looks correct to me, offset 0x18 would be nf_bridge_info->mask.
> Bart, please review, thanks.
> 
>> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
>> index 93f80fe..cd2e5f5 100644
>> --- a/net/bridge/br_netfilter.c
>> +++ b/net/bridge/br_netfilter.c
>> @@ -723,6 +723,9 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
>>  		return NF_ACCEPT;
>>  #endif
>>  
>> +	if (!skb->nf_bridge)
>> +		return NF_ACCEPT;
>> +
>>  	if (skb->protocol != htons(ETH_P_ARP)) {
>>  		if (!IS_VLAN_ARP(skb))
>>  			return NF_ACCEPT;

That won't fix it since nf_bridge isn't used in the ARP case. The
correct fix is below. Does anyone know why the null pointer
dereference (skb->nf_bridge->mask & BRNF_8021Q) in
nf_bridge_update_protocol() didn't cause my uml kernel to crash??

cheers,
Bart


Don't call nf_bridge_update_protocol() for ARP traffic as
skb->nf_bridge isn't used in the ARP case.


Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Reported-by: Stephen Hemminger <shemminger@vyatta.com>

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 93f80fe..4442099 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb)
 			skb->pkt_type = PACKET_OTHERHOST;
 			nf_bridge->mask ^= BRNF_PKT_TYPE;
 		}
+		nf_bridge_update_protocol(skb);
 	} else {
 		in = *((struct net_device **)(skb->cb));
 	}
-	nf_bridge_update_protocol(skb);
 	nf_bridge_push_encap_header(skb);
 
 	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,

-- 
Bart De Schuymer
www.artinalgorithms.be