Received-SPF: pass (google.com: domain of linux-kernel+bounces-23763-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
To: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,
	Florian Westphal <fw@strlen.de>,
	David Ahern <dsahern@kernel.org>,
	Jozsef Kadlecsik <kadlec@netfilter.org>,
	Kees Cook <keescook@chromium.org>,
	Nikolay Aleksandrov <razor@blackwall.org>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Roopa Prabhu <roopa@nvidia.com>
Cc: netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	netfilter-devel@vger.kernel.org,
	coreteam@netfilter.org,
	bridge@lists.linux.dev,
	kernel@openvz.org,
	Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Subject: [PATCH v3 0/4] netlink: bridge: fix nf_bridge->physindev use after free
Date: Thu, 11 Jan 2024 23:06:36 +0800
Message-ID: <20240111150645.85637-1-ptikhomirov@virtuozzo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?vB85gIFIdboCPNTU842ADs8n/UJ1wIrZ5/aT6LWmVnMe17OPjLWTcAri6Amt?=
 =?us-ascii?Q?iLCxcLZ7bRKniIeHlV6+795PPBrawLVpdyuW78rB4BGjWmMLSRhQ8Pb1Ang6?=
 =?us-ascii?Q?FGvbzWNVaLA32skDZzOXCgu92S8a/11Jkjwg8b4cvGNXPsD/BjVVNpt5+aEz?=
 =?us-ascii?Q?UosQXJf6TQ3WcKZ9EI+JpSis1ULjfiizP+WlK6/gB6JbHoZz/R4OZuq/wZPU?=
 =?us-ascii?Q?SkC02/nP3h1OkKZnENQ81lIrpYr8tSE4EpGjEsoG1PLRfV1ehQ/wvOZ9ksJy?=
 =?us-ascii?Q?ZKiHf+LkfgnhPHQfgk9LGQ7A8PIsmN3VuqLxW9txBh1P+CzBxAbhdLB/Gxbx?=
 =?us-ascii?Q?GeSiSC6Ce5C2PCLRdahsBqdgLxQuYnGOM7HldulW/SeMBaSzTBpDvNcZpN9q?=
 =?us-ascii?Q?bHvnMQJWz+gZqIINfxdumPwpA6DgXNtoHhza/HOn163RnA4FbamvhJh8lrTG?=
 =?us-ascii?Q?abZcPUJBDtDAAybLeAj8U/xCZ4a8VJwaQVwgAyJyxlpYcft96RruwpLu3zyy?=
 =?us-ascii?Q?KSIgmHyuIvDhWK7LqlhhxeWapulekbKbZ9poabJrDmuF31qVumiK/ILiRe7l?=
 =?us-ascii?Q?egTmDbRwPMCiGdVfjBv87XfTWo0NtFbTpUNxZm67rrhISgaxiHgAvFehwGM9?=
 =?us-ascii?Q?Ls9oTSyIRXeTcOd0QLeGBgVX8SOXHKAmCPZqTv23rOjQi55NibguGhgO9hXS?=
 =?us-ascii?Q?RRiTfQbQJ50aP/qvmjDs+R8XFZ01ZlsCanSYF6eOYZdDKaN5EgB0qPVr9IbW?=
 =?us-ascii?Q?4TzVD2LicA5DpTXvCSKztPwUBiJ8dORSlGaVKsD4U0Q9OY+xUFeYkZ7A9N5A?=
 =?us-ascii?Q?HaUxZ4uI9JabyBRDejdT4fgLjOO1sr2iQ1aRD8W1PTxQw6wNm7hIE+RMrWOQ?=
 =?us-ascii?Q?ORni/I12ZW/8luQtq53XqvTrqr3pAANG92402peaS6q25xxEL/93FARjbuaM?=
 =?us-ascii?Q?VrzpM4rOou94IeeD49KmjW2FamsJGUCSZ0RoOmL4Ox2BAadDEriyAfNzwqFc?=
 =?us-ascii?Q?RzMjy0GwlHu+647aPU1091Za8xgVMWkgcw5YiIz88w8/m7dtVf0NZsC4JaMy?=
 =?us-ascii?Q?z1F9EDFq8qpHnwcwZjlItITvyMTHVaNLRLG3Ed813py/eHrmnje2Hht/imkX?=
 =?us-ascii?Q?/81bT3ZjIho5Apt4+DFryhUnexb0dNcWRFjVj9wXhC2zhSXkrO4bUMP9nsmw?=
 =?us-ascii?Q?Y6l5dqZS0Gy001kf0mLmAVPjKUAiJay2D5lSvELJGeQ/t3ZbJZ+rBhi5vlzu?=
 =?us-ascii?Q?Qz0/8UIeDbqAkiyzv+ls/A3inUvHoB8gjwLB51OS9UgcZiykcSrLD93L0/2z?=
 =?us-ascii?Q?6aYabTZ8nKrXmLPHfEldhHxVeLbk6fzR027reB4Qv5RaCOjwIx8mQRt9bT2Q?=
 =?us-ascii?Q?Oqd2Pw0vZzqjNOONBKP7fF8ClGvN/PEoSKoz5g2sLt6I8/N/DrFaL3wRy58h?=
 =?us-ascii?Q?Sw0bfjKO7FfKro9WFPiFuL+DkPNCHzuDU3CT0YN6YqGIxuRynBn5JCknZV6l?=
 =?us-ascii?Q?ZH3KXzuqxW9E62Tq5LrjoX1Sk12y6tqdlA7umqvo43IhstEF4SkP7+RQs/ay?=
 =?us-ascii?Q?5OhCt4rB10uZgfxyz+TXpaK4mMFD+RS4rMVktpOXfzinqSnyiLW1LN2OJry4?=
 =?us-ascii?Q?dzDMz4z/WpHS5TnYdIVNnrifWVJ6+ybuRRglyFUTYP2WINlgSD7/0apHkDfS?=
 =?us-ascii?Q?HlrI5A=3D=3D?=
X-OriginatorOrg: virtuozzo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9d307970-de6c-43be-b58f-08dc12b6f7ba
X-MS-Exchange-CrossTenant-AuthSource: DU0PR08MB9003.eurprd08.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Jan 2024 15:07:03.0748
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: gakHaKqgaJlg4vpg83g6VKBD8rB1ReqbKmfJPOXGjsS6Fu3ro/bVgIXqM1meHP2YZePiEniWns9dptkRnsUf3fWjROw27Vrif1WvUhOc224=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVPR08MB9089

Code processing skb from neigh->arp_queue can access its
nf_bridge->physindev, which can already be freed, leading to crash.

So, as Florian suggests, we can put physinif on nf_bridge and peek into
the original device with dev_get_by_index_rcu(), so that we can be sure
that device is not freed under us.

This is a second attempt to fix this issue, first attempt:

"neighbour: purge nf_bridged skb from foreign device neigh"
https://lore.kernel.org/netdev/20240108085232.95437-1-ptikhomirov@virtuozzo.com/

v3: resend it to proper lists and recipients

Pavel Tikhomirov (4):
  netfilter: nfnetlink_log: use proper helper for fetching physinif
  netfilter: nf_queue: remove excess nf_bridge variable
  netfilter: propagate net to nf_bridge_get_physindev
  netfilter: bridge: replace physindev with physinif in nf_bridge_info

 include/linux/netfilter_bridge.h           |  6 ++--
 include/linux/skbuff.h                     |  2 +-
 net/bridge/br_netfilter_hooks.c            | 42 +++++++++++++++++-----
 net/bridge/br_netfilter_ipv6.c             | 14 +++++---
 net/ipv4/netfilter/nf_reject_ipv4.c        |  9 +++--
 net/ipv6/netfilter/nf_reject_ipv6.c        | 11 ++++--
 net/netfilter/ipset/ip_set_hash_netiface.c |  8 ++---
 net/netfilter/nf_log_syslog.c              | 13 +++----
 net/netfilter/nf_queue.c                   |  6 ++--
 net/netfilter/nfnetlink_log.c              |  8 ++---
 net/netfilter/xt_physdev.c                 |  2 +-
 11 files changed, 80 insertions(+), 41 deletions(-)

-- 
2.43.0