* [PATCH 4.19 0/1] Fix UBSAN: undefined-behaviour in maybe_deliver
@ 2022-01-26 3:36 ` Huang Guobin
0 siblings, 0 replies; 6+ messages in thread
From: Huang Guobin @ 2022-01-26 3:36 UTC (permalink / raw)
To: nikolay, roopa, davem; +Cc: bridge, netdev, stable
There is a syzkaller problem for Linux 4.19 last for over 1 year:
https://www.syzkaller.appspot.com/bug?id=288ae4752bb930c26369d675316de0310264ee34
Mainline patch 7d850abd5f4e(net: bridge: add support for port isolation)
introduces the BR_ISOLATED feature, a pair of ports with the BR_ISOLATED
option set cannot communicate with each other.
This feature applies only to ingress flow, not egress flow. However, the
function br_skb_isolated that checks if an interface is isolated will be
used not only for the ingress path, but also for the egress path.
Since Linux-4.19 not merge the mainline patch fd65e5a95d0838(net: bridge:
clear bridge's private skb space on xmit), the value of skb->cb is unde-
fined because it is not initialized. Therefore, checking
BR_INPUT_SKB_CB(skb)->src_port_isolated on the egress path will access an
undefined value, resulting in an error in the judgment of br_skb_isolated.
UBSAN triggers an alarm by finding undefined
BR_INPUT_SKB_CB(skb)->src_port_isolated.
So cherry-pick mainline patch fd65e5a95d0838(net: bridge: clear bridge's
private skb space on xmit) to Linux 4.19 to fix it.
Nikolay Aleksandrov (1):
net: bridge: clear bridge's private skb space on xmit
net/bridge/br_device.c | 2 ++
1 file changed, 2 insertions(+)
--
2.25.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bridge] [PATCH 4.19 0/1] Fix UBSAN: undefined-behaviour in maybe_deliver
@ 2022-01-26 3:36 ` Huang Guobin
0 siblings, 0 replies; 6+ messages in thread
From: Huang Guobin @ 2022-01-26 3:36 UTC (permalink / raw)
To: nikolay, roopa, davem; +Cc: netdev, bridge, stable
There is a syzkaller problem for Linux 4.19 last for over 1 year:
https://www.syzkaller.appspot.com/bug?id=288ae4752bb930c26369d675316de0310264ee34
Mainline patch 7d850abd5f4e(net: bridge: add support for port isolation)
introduces the BR_ISOLATED feature, a pair of ports with the BR_ISOLATED
option set cannot communicate with each other.
This feature applies only to ingress flow, not egress flow. However, the
function br_skb_isolated that checks if an interface is isolated will be
used not only for the ingress path, but also for the egress path.
Since Linux-4.19 not merge the mainline patch fd65e5a95d0838(net: bridge:
clear bridge's private skb space on xmit), the value of skb->cb is unde-
fined because it is not initialized. Therefore, checking
BR_INPUT_SKB_CB(skb)->src_port_isolated on the egress path will access an
undefined value, resulting in an error in the judgment of br_skb_isolated.
UBSAN triggers an alarm by finding undefined
BR_INPUT_SKB_CB(skb)->src_port_isolated.
So cherry-pick mainline patch fd65e5a95d0838(net: bridge: clear bridge's
private skb space on xmit) to Linux 4.19 to fix it.
Nikolay Aleksandrov (1):
net: bridge: clear bridge's private skb space on xmit
net/bridge/br_device.c | 2 ++
1 file changed, 2 insertions(+)
--
2.25.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 4.19 1/1] net: bridge: clear bridge's private skb space on xmit
2022-01-26 3:36 ` [Bridge] " Huang Guobin
@ 2022-01-26 3:36 ` Huang Guobin
-1 siblings, 0 replies; 6+ messages in thread
From: Huang Guobin @ 2022-01-26 3:36 UTC (permalink / raw)
To: nikolay, roopa, davem; +Cc: bridge, netdev, stable
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
[ Upstream commit fd65e5a95d08389444e8591a20538b3edece0e15 ]
We need to clear all of the bridge private skb variables as they can be
stale due to the packet being recirculated through the stack and then
transmitted through the bridge device. Similar memset is already done on
bridge's input. We've seen cases where proxyarp_replied was 1 on routed
multicast packets transmitted through the bridge to ports with neigh
suppress which were getting dropped. Same thing can in theory happen with
the port isolation bit as well.
Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppress arp and nd flood")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
---
net/bridge/br_device.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index a350c05b7ff5..7c6b1024dd4b 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -42,6 +42,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
struct ethhdr *eth;
u16 vid = 0;
+ memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
+
rcu_read_lock();
nf_ops = rcu_dereference(nf_br_ops);
if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [Bridge] [PATCH 4.19 1/1] net: bridge: clear bridge's private skb space on xmit
@ 2022-01-26 3:36 ` Huang Guobin
0 siblings, 0 replies; 6+ messages in thread
From: Huang Guobin @ 2022-01-26 3:36 UTC (permalink / raw)
To: nikolay, roopa, davem; +Cc: netdev, bridge, stable
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
[ Upstream commit fd65e5a95d08389444e8591a20538b3edece0e15 ]
We need to clear all of the bridge private skb variables as they can be
stale due to the packet being recirculated through the stack and then
transmitted through the bridge device. Similar memset is already done on
bridge's input. We've seen cases where proxyarp_replied was 1 on routed
multicast packets transmitted through the bridge to ports with neigh
suppress which were getting dropped. Same thing can in theory happen with
the port isolation bit as well.
Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppress arp and nd flood")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
---
net/bridge/br_device.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index a350c05b7ff5..7c6b1024dd4b 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -42,6 +42,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
struct ethhdr *eth;
u16 vid = 0;
+ memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
+
rcu_read_lock();
nf_ops = rcu_dereference(nf_br_ops);
if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 4.19 1/1] net: bridge: clear bridge's private skb space on xmit
2022-01-26 3:36 ` [Bridge] " Huang Guobin
@ 2022-01-27 15:39 ` Greg KH
-1 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2022-01-27 15:39 UTC (permalink / raw)
To: Huang Guobin; +Cc: nikolay, roopa, davem, bridge, netdev, stable
On Wed, Jan 26, 2022 at 11:36:39AM +0800, Huang Guobin wrote:
> From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
>
> [ Upstream commit fd65e5a95d08389444e8591a20538b3edece0e15 ]
>
> We need to clear all of the bridge private skb variables as they can be
> stale due to the packet being recirculated through the stack and then
> transmitted through the bridge device. Similar memset is already done on
> bridge's input. We've seen cases where proxyarp_replied was 1 on routed
> multicast packets transmitted through the bridge to ports with neigh
> suppress which were getting dropped. Same thing can in theory happen with
> the port isolation bit as well.
>
> Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppress arp and nd flood")
> Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
> ---
> net/bridge/br_device.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
> index a350c05b7ff5..7c6b1024dd4b 100644
> --- a/net/bridge/br_device.c
> +++ b/net/bridge/br_device.c
> @@ -42,6 +42,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
> struct ethhdr *eth;
> u16 vid = 0;
>
> + memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
> +
> rcu_read_lock();
> nf_ops = rcu_dereference(nf_br_ops);
> if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {
> --
> 2.25.1
>
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bridge] [PATCH 4.19 1/1] net: bridge: clear bridge's private skb space on xmit
@ 2022-01-27 15:39 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2022-01-27 15:39 UTC (permalink / raw)
To: Huang Guobin; +Cc: nikolay, netdev, roopa, bridge, stable, davem
On Wed, Jan 26, 2022 at 11:36:39AM +0800, Huang Guobin wrote:
> From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
>
> [ Upstream commit fd65e5a95d08389444e8591a20538b3edece0e15 ]
>
> We need to clear all of the bridge private skb variables as they can be
> stale due to the packet being recirculated through the stack and then
> transmitted through the bridge device. Similar memset is already done on
> bridge's input. We've seen cases where proxyarp_replied was 1 on routed
> multicast packets transmitted through the bridge to ports with neigh
> suppress which were getting dropped. Same thing can in theory happen with
> the port isolation bit as well.
>
> Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppress arp and nd flood")
> Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
> ---
> net/bridge/br_device.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
> index a350c05b7ff5..7c6b1024dd4b 100644
> --- a/net/bridge/br_device.c
> +++ b/net/bridge/br_device.c
> @@ -42,6 +42,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
> struct ethhdr *eth;
> u16 vid = 0;
>
> + memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
> +
> rcu_read_lock();
> nf_ops = rcu_dereference(nf_br_ops);
> if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {
> --
> 2.25.1
>
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-01-27 15:39 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-26 3:36 [PATCH 4.19 0/1] Fix UBSAN: undefined-behaviour in maybe_deliver Huang Guobin
2022-01-26 3:36 ` [Bridge] " Huang Guobin
2022-01-26 3:36 ` [PATCH 4.19 1/1] net: bridge: clear bridge's private skb space on xmit Huang Guobin
2022-01-26 3:36 ` [Bridge] " Huang Guobin
2022-01-27 15:39 ` Greg KH
2022-01-27 15:39 ` [Bridge] " Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.