Received-SPF: pass (google.com: domain of linux-kernel+bounces-22037-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
To: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,
	Florian Westphal <fw@strlen.de>
Cc: netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	kernel@openvz.org,
	Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Subject: [PATCH 0/4] netlink: bridge: fix nf_bridge->physindev use after free
Date: Wed, 10 Jan 2024 19:00:10 +0800
Message-ID: <20240110110451.5473-1-ptikhomirov@virtuozzo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?CorPpyzU60oZikcKOEkgwAYW1N9BvCSqw5kQ0uL9SDeAmGUk9azMUQG3CwMQ?=
 =?us-ascii?Q?ZWC2Aq/ACb6tV4peZZtvHyvWhgQP5hASMcS1glhowzdleVsWwHLYjVn9WzLm?=
 =?us-ascii?Q?lLplgUbuIdW7tqvExX9Ri5wdNmtVdAgcnyQQuOJ0DGa6F8/S/3tYSuwRT2kr?=
 =?us-ascii?Q?YVT5dikHWRtnCUg+jyTbMTUS23vX9fp9h3bJCovvN5qiopj+cJIKpQkfLXK9?=
 =?us-ascii?Q?Zl0lxy37s9bLH2jKn3Aa1T2Or2+2K9ZlieIjrAP0PIA7rK0tsdT9WUgrxZcW?=
 =?us-ascii?Q?d0jNjlU8Gs4IcBvhdVOkpVfuxkjpRUKSG5BCoMovlymVCwUHN/Z+WaZFJtJc?=
 =?us-ascii?Q?XpsYOUwH2PSOk7+VLuZ9gUsllxr5t+iF2sjnYhWWt33sBOrgeeMW4VlfoQBF?=
 =?us-ascii?Q?INpo2blMTC5RFtlI94gWQv3S4njS5aQ7U6YrVkEhMgvLp89+2N79DwPq+hGQ?=
 =?us-ascii?Q?8gTnFtI1+bTXSVF4sAOYeuGngDMgqiRsofLwZiKWXv41qf6e+zBa+Pa9SABG?=
 =?us-ascii?Q?RpjORfnRjKm4ojX4q89DGyS4bM4xz7B8mOwsg25613cePs95bNVNQ++NmwH2?=
 =?us-ascii?Q?kMWbuMGrzBvHpYyeEhuQ480zHg1dkTM51cxIKNQsp8MVfTQFuCkqAbFZOttp?=
 =?us-ascii?Q?6JYbgR3qH3A4w4cJuYpISNttZE/XnAcG0Peai+711TY7GZhmAUgHyzbVe/1i?=
 =?us-ascii?Q?IusKkUh/uVdk1KWx/dW5zg+2IS5jV1zWp5hdAAczgo6+CxgbNSuGHTzv1W6K?=
 =?us-ascii?Q?4e/ySQH+ch6rQlAuCoVyhfxu8NvdsCpiIavtQi2n2yATBpAtEtb1QD4mKQY0?=
 =?us-ascii?Q?B4FwFjpuj8iM9m8IfZwgxYKHp2q7uG3yT+0mi7uFgrIniacN60mRMMcZu2nD?=
 =?us-ascii?Q?ANvBgl2edIw7K5nBL8unKZBfe4oW1Bedntd1oikxlicpLh0zFunfx3Kyredb?=
 =?us-ascii?Q?xC6LYQAzz7AG1/hIK06KZ1gIxrGsr3xtCSIWBC81QN27vKdEkGDJ9sp3lzXB?=
 =?us-ascii?Q?qEicsGa7sblluSzpid/qdGyS9AWDwMSqjrVo0u6gD/Txyq5hEU2AQSDeAuDD?=
 =?us-ascii?Q?wgFXmjafb8jFr6qALJWYGMUVFseKCHS/tpu39SHJ0lG5opbkmPBtC7CLJUcO?=
 =?us-ascii?Q?tEKigZ75MSgzAhst8cKJh8vEL/hgI7rbfBDldLgq/ETaAepCNLN42HYKBDgo?=
 =?us-ascii?Q?Hu5Zzc25nmd+r2rds0RuY08ur2rTNroQJZHq2yZsXwcUK1N+InPbaO5TzLzN?=
 =?us-ascii?Q?IlhBI0vNI4fTuIaLNrjSOND2TgHdrWNFW7Zxvl7YwFTIjew5J8Nzij6AZGEm?=
 =?us-ascii?Q?/BQptuYiPnFNRx1dqABxbzUsgUU6sUKe3A/ROeSBxH6jVT6cPI9eHdLIWA6v?=
 =?us-ascii?Q?bsxVotC+LJETTxnFUY2j13YVLHbYApqpYVGD0SFeAppt5BpQpFmW5i3hIC+Z?=
 =?us-ascii?Q?A3vmHsdC1T6wx0EOJ+j3CxqUMVM3A/A1hm2GRaKHKl4pcXD0Qm/zHQLGuOhF?=
 =?us-ascii?Q?+WPX70afVXby3pwQJDMsNUihTbn/vh5I0DffneCXWBJBnIWK6epU4J+OLxUi?=
 =?us-ascii?Q?5opte7fpPAbMurohLPNt46Q0QSRd3PfqOqAW9z4v3N/k2UYZP1vtrhi8dR37?=
 =?us-ascii?Q?PL0hPETirsHd5CfRHDgrjj9tSgHLoXdUm9rycQ0No5LeqTjwnwgpQwaeLRwf?=
 =?us-ascii?Q?6FutAg=3D=3D?=
X-OriginatorOrg: virtuozzo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2b5fa989-8392-4281-a04b-08dc11cc04e1
X-MS-Exchange-CrossTenant-AuthSource: DU0PR08MB9003.eurprd08.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Jan 2024 11:05:13.3914
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: T8HnLPXhEbO5V2R6X62rr2yVP000OGzOXnWll2xK5L/bSOvxVV/xqp9YWHDt0DR5CrsUmiXpiAUJJ32GrTsggTOiH4HgvglmCG/7s6F8cpM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB5990

Code processing skb from neigh->arp_queue can access its
nf_bridge->physindev, which can already be freed, leading to crash.

So, as Florian suggests, we can put physinif on nf_bridge and peek into
the original device with dev_get_by_index_rcu(), so that we can be sure
that device is not freed under us.

This is a second attempt to fix this issue, first attempt:

"neighbour: purge nf_bridged skb from foreign device neigh"
https://lore.kernel.org/netdev/20240108085232.95437-1-ptikhomirov@virtuozzo.com/

Pavel Tikhomirov (4):
  netfilter: nfnetlink_log: use proper helper for fetching physinif
  netfilter: nf_queue: remove excess nf_bridge variable
  netfilter: propagate net to nf_bridge_get_physindev
  netfilter: bridge: replace physindev with physinif in nf_bridge_info

 include/linux/netfilter_bridge.h           |  6 ++--
 include/linux/skbuff.h                     |  2 +-
 net/bridge/br_netfilter_hooks.c            | 42 +++++++++++++++++-----
 net/bridge/br_netfilter_ipv6.c             | 14 +++++---
 net/ipv4/netfilter/nf_reject_ipv4.c        |  9 +++--
 net/ipv6/netfilter/nf_reject_ipv6.c        | 11 ++++--
 net/netfilter/ipset/ip_set_hash_netiface.c |  8 ++---
 net/netfilter/nf_log_syslog.c              | 13 +++----
 net/netfilter/nf_queue.c                   |  6 ++--
 net/netfilter/nfnetlink_log.c              | 13 +++----
 net/netfilter/xt_physdev.c                 |  2 +-
 11 files changed, 83 insertions(+), 43 deletions(-)

-- 
2.43.0