Commit 823d81b0 authored Feb 24, 2020 by Nikolay Aleksandrov Committed by David S. Miller Feb 24, 2020

net: bridge: fix stale eth hdr pointer in br_dev_xmit

In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but
if the packet has the vlan header inside (e.g. bridge with disabled
tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag()
to extract the vid before filtering which in turn calls pskb_may_pull()
and we may end up with a stale eth pointer. Moreover the cached eth header
pointer will generally be wrong after that operation. Remove the eth header
caching and just use eth_hdr() directly, the compiler does the right thing
and calculates it only once so we don't lose anything.

Fixes: 057658cb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent e4686c2d

net/bridge/br_device.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -34,7 +34,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff skb, struct net_device dev)
		const struct nf_br_ops *nf_ops;
		u8 state = BR_STATE_FORWARDING;
		const unsigned char *dest;
		struct ethhdr *eth;
		u16 vid = 0;

		rcu_read_lock();
		@@ -54,15 +53,14 @@ netdev_tx_t br_dev_xmit(struct sk_buff skb, struct net_device dev)
		BR_INPUT_SKB_CB(skb)->frag_max_size = 0;

		skb_reset_mac_header(skb);
		eth = eth_hdr(skb);
		skb_pull(skb, ETH_HLEN);

		if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, &vid, &state))
		goto out;

		if (IS_ENABLED(CONFIG_INET) &&
		(eth->h_proto == htons(ETH_P_ARP) \|\|
		eth->h_proto == htons(ETH_P_RARP)) &&
		(eth_hdr(skb)->h_proto == htons(ETH_P_ARP) \|\|
		eth_hdr(skb)->h_proto == htons(ETH_P_RARP)) &&
		br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED)) {
		br_do_proxy_suppress_arp(skb, br, vid, NULL);
		} else if (IS_ENABLED(CONFIG_IPV6) &&

Admin message