Pablo Neira Ayuso 4319317451 netfilter: br_netfilter: skip conntrack input hook for promisc packets ... [ Upstream commit 751de2012e ] For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaround to reset conntrack for these packets. Jianbo Liu reports warning splats in their test infrastructure where cloned packets reach the br_netfilter input hook to confirm the conntrack object. Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet has reached the input hook because it is passed up to the bridge device to reach the taps. [ 57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core [ 57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19 [ 57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1 [ 57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202 [ 57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000 [ 57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000 [ 57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003 [ 57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000 [ 57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800 [ 57.582313] FS: 0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000 [ 57.583040] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0 [ 57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.585440] Call Trace: [ 57.585721] <IRQ> [ 57.585976] ? __warn+0x7d/0x130 [ 57.586323] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.586811] ? report_bug+0xf1/0x1c0 [ 57.587177] ? handle_bug+0x3f/0x70 [ 57.587539] ? exc_invalid_op+0x13/0x60 [ 57.587929] ? asm_exc_invalid_op+0x16/0x20 [ 57.588336] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.588825] nf_hook_slow+0x3d/0xd0 [ 57.589188] ? br_handle_vlan+0x4b/0x110 [ 57.589579] br_pass_frame_up+0xfc/0x150 [ 57.589970] ? br_port_flags_change+0x40/0x40 [ 57.590396] br_handle_frame_finish+0x346/0x5e0 [ 57.590837] ? ipt_do_table+0x32e/0x430 [ 57.591221] ? br_handle_local_finish+0x20/0x20 [ 57.591656] br_nf_hook_thresh+0x4b/0xf0 [br_netfilter] [ 57.592286] ? br_handle_local_finish+0x20/0x20 [ 57.592802] br_nf_pre_routing_finish+0x178/0x480 [br_netfilter] [ 57.593348] ? br_handle_local_finish+0x20/0x20 [ 57.593782] ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat] [ 57.594279] br_nf_pre_routing+0x24c/0x550 [br_netfilter] [ 57.594780] ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter] [ 57.595280] br_handle_frame+0x1f3/0x3d0 [ 57.595676] ? br_handle_local_finish+0x20/0x20 [ 57.596118] ? br_handle_frame_finish+0x5e0/0x5e0 [ 57.596566] __netif_receive_skb_core+0x25b/0xfc0 [ 57.597017] ? __napi_build_skb+0x37/0x40 [ 57.597418] __netif_receive_skb_list_core+0xfb/0x220 Fixes: 62e7151ae3 ("netfilter: bridge: confirm multicast packets before passing them up the stack") Reported-by: Jianbo Liu <jianbol@nvidia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-27 17:12:49 +02:00
..
6lowpan	net: fill in MODULE_DESCRIPTION()s for 6LoWPAN	2024-02-09 14:12:01 -08:00
9p	9p: Fix read/write debug statements to report server reply	2024-04-10 16:38:09 +02:00
802	net: fill in MODULE_DESCRIPTION()s under net/802*	2023-10-28 11:29:28 +01:00
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-01-19 21:25:06 -08:00
appletalk	net: remove SOCK_DEBUG leftovers	2023-12-26 20:31:01 +00:00
atm	net: fill in MODULE_DESCRIPTION()s for mpoa	2024-02-09 14:12:01 -08:00
ax25	ax25: fix use-after-free bugs caused by ax25_ds_del_timer	2024-04-10 16:38:06 +02:00
batman-adv	batman-adv: Avoid infinite loop trying to resize local TT	2024-04-17 11:23:24 +02:00
bluetooth	Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit	2024-04-17 11:23:32 +02:00
bpf	bpf: Fix dtor CFI	2023-12-15 16:25:55 -08:00
bridge	netfilter: br_netfilter: skip conntrack input hook for promisc packets	2024-04-27 17:12:49 +02:00
caif	net: fill in MODULE_DESCRIPTION()s for CAIF	2024-01-05 08:06:35 -08:00
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-14 13:53:03 +01:00
ceph	libceph: init the cursor when preparing sparse read in msgr2	2024-03-06 12:43:01 +01:00
core	netdev: let netlink core handle -EMSGSIZE errors	2024-04-13 13:10:02 +02:00
dcb
dccp	net: remove SOCK_DEBUG leftovers	2023-12-26 20:31:01 +00:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:17:36 -04:00
dns_resolver	Networking changes for 6.8.	2024-01-11 10:07:29 -08:00
dsa	net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events	2024-01-11 16:33:52 -08:00
ethernet
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-18 13:21:06 +01:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-08 18:32:29 -08:00
hsr	net: hsr: hsr_slave: Fix the promiscuous mode in offload mode	2024-04-10 16:37:56 +02:00
ieee802154	mac802154: Avoid new associations while disassociating	2023-12-15 11:14:57 +01:00
ife	net: sched: ife: fix potential use-after-free	2023-12-15 10:50:18 +00:00
ipv4	netfilter: complete validation of user input	2024-04-17 11:23:32 +02:00
ipv6	netfilter: complete validation of user input	2024-04-17 11:23:32 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-02-16 09:25:09 +00:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:16:57 -04:00
key	net: fill in MODULE_DESCRIPTION()s for af_key	2024-02-09 14:12:01 -08:00
l2tp	l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function	2024-03-26 18:16:57 -04:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-01-30 13:49:09 +01:00
mac80211	wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes	2024-04-03 15:32:38 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-04-03 15:32:15 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:16:49 -04:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:10:12 +02:00
mptcp	mptcp: don't account accept() of non-MPC client as fallback to TCP	2024-04-10 16:38:09 +02:00
ncsi	net/ncsi: Add NC-SI 1.2 Get MC MAC Address command	2023-11-18 15:00:51 +00:00
netfilter	netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()	2024-04-27 17:12:49 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2023-12-07 14:23:12 -05:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-02-22 18:56:09 -08:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-07 10:36:58 +01:00
nfc	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:37:54 +02:00
nsh
openvswitch	net: openvswitch: fix unwanted error log on timeout policy probing	2024-04-17 11:23:28 +02:00
packet	packet: annotate data-races around ignore_outgoing	2024-03-26 18:17:34 -04:00
phonet	phonet/pep: fix racy skb_queue_empty() use	2024-02-22 09:05:50 +01:00
psample	genetlink: Use internal flags for multicast groups	2023-12-29 08:43:59 +00:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-01 18:41:29 +00:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:38:02 +02:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-12-21 22:17:23 +01:00
rose	net/rose: fix races in rose_kill_by_device()	2023-12-15 11:59:53 +00:00
rxrpc	rxrpc: Fix counting of new acks and nacks	2024-02-05 12:34:07 +00:00
sched	net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()	2024-04-10 16:38:04 +02:00
sctp	net: sctp: fix skb leak in sctp_inq_free()	2024-02-15 07:34:52 -08:00
smc	net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()	2024-04-13 13:10:02 +02:00
strparser
sunrpc	SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP	2024-04-10 16:38:14 +02:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-02-16 09:36:37 +00:00
tipc	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-06 08:49:26 +01:00
tls	tls: get psock ref after taking rxlock to avoid leak	2024-04-10 16:37:57 +02:00
unix	af_unix: Fix garbage collector racing against connect()	2024-04-17 11:23:34 +02:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:38:03 +02:00
wireless	wifi: cfg80211: check A-MSDU format more carefully	2024-04-13 13:10:01 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:16:57 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:23:28 +02:00
xfrm	xfrm: Allow UDP encapsulation only in offload modes	2024-03-26 18:17:34 -04:00
compat.c	file: stop exposing receive_fd_user()	2023-12-12 14:24:14 +01:00
devres.c
Kconfig	bpfilter: remove bpfilter	2024-01-04 10:23:10 -08:00
Kconfig.debug
Makefile	bpfilter: remove bpfilter	2024-01-04 10:23:10 -08:00
socket.c	vfs-6.8.iov_iter	2024-01-08 11:43:04 -08:00
sysctl_net.c