Patch "netfilter: br_netfilter: fix recent physdev match breakage" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: br_netfilter: fix recent physdev match breakage

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-br_netfilter-fix-recent-physdev-match-brea.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 77200266a1a3d4a28104e3e5d15afda15cf29b89
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Mon Apr 3 13:54:37 2023 +0200

    netfilter: br_netfilter: fix recent physdev match breakage
    
    [ Upstream commit 94623f579ce338b5fa61b5acaa5beb8aa657fb9e ]
    
    Recent attempt to ensure PREROUTING hook is executed again when a
    decrypted ipsec packet received on a bridge passes through the network
    stack a second time broke the physdev match in INPUT hook.
    
    We can't discard the nf_bridge info strct from sabotage_in hook, as
    this is needed by the physdev match.
    
    Keep the struct around and handle this with another conditional instead.
    
    Fixes: 2b272bb558f1 ("netfilter: br_netfilter: disable sabotage_in hook after first suppression")
    Reported-and-tested-by: Farid BENAMROUCHE <fariouche@xxxxxxxx>
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 19e595cab23ac..ef00dd3108362 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -259,6 +259,7 @@ struct nf_bridge_info {
 	u8			pkt_otherhost:1;
 	u8			in_prerouting:1;
 	u8			bridged_dnat:1;
+	u8			sabotage_in_done:1;
 	__u16			frag_max_size;
 	struct net_device	*physindev;
 
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index f3c7cfba31e1b..f14beb9a62edb 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -868,12 +868,17 @@ static unsigned int ip_sabotage_in(void *priv,
 {
 	struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 
-	if (nf_bridge && !nf_bridge->in_prerouting &&
-	    !netif_is_l3_master(skb->dev) &&
-	    !netif_is_l3_slave(skb->dev)) {
-		nf_bridge_info_free(skb);
-		state->okfn(state->net, state->sk, skb);
-		return NF_STOLEN;
+	if (nf_bridge) {
+		if (nf_bridge->sabotage_in_done)
+			return NF_ACCEPT;
+
+		if (!nf_bridge->in_prerouting &&
+		    !netif_is_l3_master(skb->dev) &&
+		    !netif_is_l3_slave(skb->dev)) {
+			nf_bridge->sabotage_in_done = 1;
+			state->okfn(state->net, state->sk, skb);
+			return NF_STOLEN;
+		}
 	}
 
 	return NF_ACCEPT;