Re: [PATCH v3 0/4] netlink: bridge: fix nf_bridge->physindev use after free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jan 11, 2024 at 11:06:36PM +0800, Pavel Tikhomirov wrote:
> Code processing skb from neigh->arp_queue can access its
> nf_bridge->physindev, which can already be freed, leading to crash.
> 
> So, as Florian suggests, we can put physinif on nf_bridge and peek into
> the original device with dev_get_by_index_rcu(), so that we can be sure
> that device is not freed under us.
> 
> This is a second attempt to fix this issue, first attempt:
> 
> "neighbour: purge nf_bridged skb from foreign device neigh"
> https://lore.kernel.org/netdev/20240108085232.95437-1-ptikhomirov@xxxxxxxxxxxxx/

I have applied this series to nf.git

I have added a Fixed: tag sufficiently old to the patch fix so it can
reach -stable at some point.

My understanding is that this problem has been always there for
br_netfilter.




[Index of Archives]     [Netdev]     [AoE Tools]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]     [Video 4 Linux]

  Powered by Linux