]> git.baikalelectronics.ru Git - kernel.git/commit
bridge: drop netfilter fake rtable unconditionally
authorFlorian Westphal <fw@strlen.de>
Mon, 13 Mar 2017 16:38:17 +0000 (17:38 +0100)
committerDavid S. Miller <davem@davemloft.net>
Mon, 13 Mar 2017 20:01:10 +0000 (13:01 -0700)
commit1f92fd843db3b167e085ec4b0d68077cb17a1ad7
treee561267a6154a99ad18ddf59bab6ce0e584347ac
parentf2bd0b8967003b5a6fbd891f720df41dfbced82b
bridge: drop netfilter fake rtable unconditionally

Andreas reports kernel oops during rmmod of the br_netfilter module.
Hannes debugged the oops down to a NULL rt6info->rt6i_indev.

Problem is that br_netfilter has the nasty concept of adding a fake
rtable to skb->dst; this happens in a br_netfilter prerouting hook.

A second hook (in bridge LOCAL_IN) is supposed to remove these again
before the skb is handed up the stack.

However, on module unload hooks get unregistered which means an
skb could traverse the prerouting hook that attaches the fake_rtable,
while the 'fake rtable remove' hook gets removed from the hooklist
immediately after.

Fixes: 5891c05e0a59c844664 ("netfilter: bridge: move br_netfilter out of the core")
Reported-by: Andreas Karis <akaris@redhat.com>
Debugged-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bridge/br_input.c
net/bridge/br_netfilter_hooks.c