• Michael Braun's avatar
    bridge: Fix br_forward crash in promiscuous mode · 7f7708f0
    Michael Braun authored
    From: Michael Braun <michael-dev@fami-braun.de>
    
    bridge: Fix br_forward crash in promiscuous mode
    
    It's a linux-next kernel from 2010-03-12 on an x86 system and it
    OOPs in the bridge module in br_pass_frame_up (called by
    br_handle_frame_finish) because brdev cannot be dereferenced (its set to
    a non-null value).
    
    Adding some BUG_ON statements revealed that
     BR_INPUT_SKB_CB(skb)->brdev == br-dev
    (as set in br_handle_frame_finish first)
    only holds until br_forward is called.
    The next call to br_pass_frame_up then fails.
    
    Digging deeper it seems that br_forward either frees the skb or passes
    it to NF_HOOK which will in turn take care of freeing the skb. The
    same is holds for br_pass_frame_ip. So it seems as if two independent
    skb allocations are required. As far as I can see, commit
    b33084be ("bridge: Avoid unnecessary
    clone on forward path") removed skb duplication and so likely causes
    this crash. This crash does not happen on 2.6.33.
    
    I've therefore modified br_forward the same way br_flood has been
    modified so that the skb is not freed if skb0 is going to be used
    and I can confirm that the attached patch resolves the issue for me.
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    7f7708f0
br_input.c 4.45 KB