From: Ido Schimmel <idosch@xxxxxxxxxxxx>
Date: Tue, 7 Jun 2016 12:06:58 +0300
> Commit 8626c56c8279 ("bridge: fix potential use-after-free when hook
> returns QUEUE or STOLEN verdict") fixed incorrect usage of NF_HOOK's
> return value by consuming packets in okfn via br_pass_frame_up().
>
> However, this function re-injects packets to the Rx path with skb->dev
> set to the bridge device, which breaks kernel's STP, as all STP packets
> appear to originate from the bridge device itself.
>
> Instead, if STP is enabled and bridge isn't a 802.1ad bridge, then learn
> packet's SMAC and inject it back to the Rx path for further processing
> by the packet handlers.
>
> The patch also makes netfilter's behavior consistent with regards to
> packets destined to the Bridge Group Address, as no hook registered at
> LOCAL_IN will ever be called, regardless if STP is enabled or not.
>
> Cc: Florian Westphal <fw@xxxxxxxxx>
> Cc: Shmulik Ladkani <shmulik.ladkani@xxxxxxxxx>
> Cc: Toshiaki Makita <makita.toshiaki@xxxxxxxxxxxxx>
> Fixes: 8626c56c8279 ("bridge: fix potential use-after-free when hook returns QUEUE or STOLEN verdict")
> Signed-off-by: Jiri Pirko <jiri@xxxxxxxxxxxx>
> Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxxxx>
Applied, thanks.
