From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Fri, 30 Aug 2019 22:58:02 +0200 From: Florian Westphal Message-ID: <20190830205802.GS20113@breakpoint.cc> References: <20190830181354.26279-1-leonardo@linux.ibm.com> <20190830181354.26279-2-leonardo@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190830181354.26279-2-leonardo@linux.ibm.com> Subject: Re: [Bridge] [PATCH v4 1/2] netfilter: Terminate rule eval if protocol=IPv6 and ipv6 module is disabled List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Leonardo Bras Cc: Nikolay Aleksandrov , netdev@vger.kernel.org, Roopa Prabhu , bridge@lists.linux-foundation.org, Florian Westphal , linux-kernel@vger.kernel.org, Jozsef Kadlecsik , coreteam@netfilter.org, netfilter-devel@vger.kernel.org, "David S. Miller" , Pablo Neira Ayuso Leonardo Bras wrote: > If IPv6 is disabled on boot (ipv6.disable=1), but nft_fib_inet ends up > dealing with a IPv6 packet, it causes a kernel panic in > fib6_node_lookup_1(), crashing in bad_page_fault. > > The panic is caused by trying to deference a very low address (0x38 > in ppc64le), due to ipv6.fib6_main_tbl = NULL. > BUG: Kernel NULL pointer dereference at 0x00000038 > > The kernel panic was reproduced in a host that disabled IPv6 on boot and > have to process guest packets (coming from a bridge) using it's ip6tables. > > Terminate rule evaluation when packet protocol is IPv6 but the ipv6 module > is not loaded. > > Signed-off-by: Leonardo Bras Acked-by: Florian Westphal