From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FC37C43603 for ; Sun, 8 Dec 2019 23:32:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1EB06206DB for ; Sun, 8 Dec 2019 23:32:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726860AbfLHXcG (ORCPT ); Sun, 8 Dec 2019 18:32:06 -0500 Received: from Chamillionaire.breakpoint.cc ([193.142.43.52]:36832 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726811AbfLHXcF (ORCPT ); Sun, 8 Dec 2019 18:32:05 -0500 Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1ie61r-0004Ux-1X; Mon, 09 Dec 2019 00:31:55 +0100 Date: Mon, 9 Dec 2019 00:31:55 +0100 From: Florian Westphal To: Eric Dumazet Cc: Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , netfilter-devel@vger.kernel.org, netdev , Eric Dumazet , syzbot Subject: Re: [PATCH netfilter] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() Message-ID: <20191208233155.GH795@breakpoint.cc> References: <20191207224339.91704-1-edumazet@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20191207224339.91704-1-edumazet@google.com> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Eric Dumazet wrote: > syzbot is kind enough to remind us we need to call skb_may_pull() [..] > Fixes: c4e70a87d975 ("netfilter: bridge: rename br_netfilter.c to br_netfilter_hooks.c") > Signed-off-by: Eric Dumazet > Reported-by: syzbot > --- > > Note: Fixes: tag does not point to real bug origin, but is old enough > to cover all stable versions. Indeed, looks like a day0 bug. We don't have this problem for ipv4/6 because the prerouting hook does pskb_may_pull() as part of ipv4/6 header checks. Arp doesn't have anything like it. > nf_bridge_pull_encap_header(skb); > } > > + if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr)))) > + return NF_DROP; > + > if (arp_hdr(skb)->ar_pln != 4) { Thats indeed the only location where we call NFPROTO_ARP hooks, so this looks like the proper fix/location. Thanks Eric! Reviewed-by: Florian Westphal