From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Sat, 31 Aug 2019 10:38:59 +0200 From: Florian Westphal Message-ID: <20190831083859.GT20113@breakpoint.cc> References: <20190831044032.31931-1-leonardo@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190831044032.31931-1-leonardo@linux.ibm.com> Subject: Re: [Bridge] [PATCH v5 1/1] net: br_netfiler_hooks: Drops IPv6 packets if IPv6 module is not loaded List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Leonardo Bras Cc: Nikolay Aleksandrov , netdev@vger.kernel.org, Roopa Prabhu , bridge@lists.linux-foundation.org, Florian Westphal , linux-kernel@vger.kernel.org, Jozsef Kadlecsik , coreteam@netfilter.org, netfilter-devel@vger.kernel.org, "David S. Miller" , Pablo Neira Ayuso Leonardo Bras wrote: > A kernel panic can happen if a host has disabled IPv6 on boot and have to > process guest packets (coming from a bridge) using it's ip6tables. > > IPv6 packets need to be dropped if the IPv6 module is not loaded, and the > host ip6tables will be used. > > Signed-off-by: Leonardo Bras > --- > Changes from v4: > - Check if the host ip6tables is going to be used before testing > ipv6 module presence > - Adds a warning about ipv6 module disabled. > > > net/bridge/br_netfilter_hooks.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c > index d3f9592f4ff8..af7800103e51 100644 > --- a/net/bridge/br_netfilter_hooks.c > +++ b/net/bridge/br_netfilter_hooks.c > @@ -496,6 +496,10 @@ static unsigned int br_nf_pre_routing(void *priv, > if (!brnet->call_ip6tables && > !br_opt_get(br, BROPT_NF_CALL_IP6TABLES)) > return NF_ACCEPT; > + if (!ipv6_mod_enabled()) { > + pr_warn_once("Module ipv6 is disabled, so call_ip6tables is not supported."); > + return NF_DROP; > + } pr_warn_once needs a '\n'. Pablo, can you mangle this locally when applying? Patch looks good to me, so: Acked-by: Florian Westphal