Patch "netfilter: nf_dup_netdev: do not push mac header a second time" has been added to the 5.18-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: nf_dup_netdev: do not push mac header a second time

to the 5.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_dup_netdev-do-not-push-mac-header-a-sec.patch
and it can be found in the queue-5.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit eac150702149ec9cfe90ccfb1fff363529d285e1
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Mon Jun 20 16:17:30 2022 +0200

    netfilter: nf_dup_netdev: do not push mac header a second time
    
    [ Upstream commit 574a5b85dc3b9ab672ff3fba0ee020f927960648 ]
    
    Eric reports skb_under_panic when using dup/fwd via bond+egress hook.
    Before pushing mac header, we should make sure that we're called from
    ingress to put back what was pulled earlier.
    
    In egress case, the MAC header is already there; we should leave skb
    alone.
    
    While at it be more careful here: skb might have been altered and
    headroom reduced, so add a skb_cow() before so that headroom is
    increased if necessary.
    
    nf_do_netdev_egress() assumes skb ownership (it normally ends with
    a call to dev_queue_xmit), so we must free the packet on error.
    
    Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
    Reported-by: Eric Garver <eric@xxxxxxxxxxx>
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index 7873bd1389c3..13b7f6a66086 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -13,10 +13,16 @@
 #include <net/netfilter/nf_tables_offload.h>
 #include <net/netfilter/nf_dup_netdev.h>
 
-static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev)
+static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
+				enum nf_dev_hooks hook)
 {
-	if (skb_mac_header_was_set(skb))
+	if (hook == NF_NETDEV_INGRESS && skb_mac_header_was_set(skb)) {
+		if (skb_cow_head(skb, skb->mac_len)) {
+			kfree_skb(skb);
+			return;
+		}
 		skb_push(skb, skb->mac_len);
+	}
 
 	skb->dev = dev;
 	skb_clear_tstamp(skb);
@@ -33,7 +39,7 @@ void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif)
 		return;
 	}
 
-	nf_do_netdev_egress(pkt->skb, dev);
+	nf_do_netdev_egress(pkt->skb, dev, nft_hook(pkt));
 }
 EXPORT_SYMBOL_GPL(nf_fwd_netdev_egress);
 
@@ -48,7 +54,7 @@ void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif)
 
 	skb = skb_clone(pkt->skb, GFP_ATOMIC);
 	if (skb)
-		nf_do_netdev_egress(skb, dev);
+		nf_do_netdev_egress(skb, dev, nft_hook(pkt));
 }
 EXPORT_SYMBOL_GPL(nf_dup_netdev_egress);