Re: [PATCH nf 1/1] netfilter: nf_queue: hold bridge skb->dev while queued

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Tue, May 12, 2026 at 03:57:25PM +0800, Ren Wei wrote:
> > From: Haoze Xie <royenheart@gmail.com>
> > 
> > br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge
> > master before queueing bridge LOCAL_IN packets. NFQUEUE only holds
> > references on state.in/out and bridge physdevs, so a queued bridge
> > packet can retain a freed bridge master in skb->dev until reinjection.
> > 
> > When the verdict is reinjected later, br_netif_receive_skb() re-enters
> > the receive path with skb->dev still pointing at the freed bridge master,
> > triggering a use-after-free.
> > 
> > Store skb->dev in the queue entry for bridge builds, hold a reference on
> > it for the queue lifetime, and use the saved device when dropping queued
> > packets during NETDEV_DOWN handling.
> 
> Next attempt: Maybe hold reference on skb->dev...

> diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
> index a6c81c04b3a5..26a4db5e17d4 100644
> --- a/net/netfilter/nf_queue.c
> +++ b/net/netfilter/nf_queue.c
> @@ -66,6 +66,7 @@ static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
>  	if (state->sk)
>  		nf_queue_sock_put(state->sk);
>  
> +	dev_put(entry->skb->dev);
>  #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
>  	dev_put(entry->physin);
>  	dev_put(entry->physout);
> @@ -104,6 +105,7 @@ bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
>  
>  	dev_hold(state->in);
>  	dev_hold(state->out);
> +	dev_hold(entry->skb->dev);

We should also extend

net/netfilter/nfnetlink_queue.c:dev_cmp() to consider skb->dev, if set.

And I think skb->dev can be NULL here in output path.