Bug#668511: Kernel panic with bridge networking

[Jonathan Nieder]

reassign 668511 src:linux-2.6 3.2.12-1
forwarded 668511 http://thread.gmane.org/gmane.linux.kernel/1283112
tags 668511 + upstream patch moreinfo
quit

Massimo Cetra wrote:

> [Subject: Bug#668511: Patch for this panic]

Please keep in mind that these appear as emails in a crowded inbox,
so the subject line can be a good place to put valuable context.

> the patch for this problem has been submitted to netdev and is here:

Thanks!  Does the patch work against 3.2.y?  See [1] for instructions.

Hope that helps,
Jonathan

[1] 
http://kernel-handbook.alioth.debian.org/ch-common-tasks.html#s-common-official
or the corresponding page in the debian-kernel-handbook package

From: "Peter Huang (Peng)" <peter.huangp...@huawei.com>
Date: Tue, 17 Apr 2012 14:22:26 +0800
Subject: set fake_rtable's dst to NULL to avoid kernel Oops.

When bridge is deleted before tap/vif device's delete, kernel may encounter an 
oops because of NULL reference to fake_rtable's dst.
Set fake_rtable's dst to NULL before sending packets out can solve this problem.

Acked-by: Eric Dumazet <eric.duma...@gmail.com>
Signed-off-by: Peter Huang <peter.huangp...@huawei.com>
Signed-off-by: Jonathan Nieder <jrnie...@gmail.com>
---
 include/linux/netfilter_bridge.h |    8 ++++++++
 net/bridge/br_forward.c          |    1 +
 net/bridge/br_netfilter.c        |    6 +-----
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 0ddd161f3b06..70744fe5dcf0 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -104,9 +104,17 @@ struct bridge_skb_cb {
        } daddr;
 };
 
+static inline void br_drop_fake_rtable(struct sk_buff *skb) {
+       struct dst_entry *dst = skb_dst(skb);
+       /* abuse fact that only fake_rtable has DST_NOPEER set */
+       if (dst && (dst->flags & DST_NOPEER))
+               skb_dst_drop(skb);
+}
+
 #else
 #define nf_bridge_maybe_copy_header(skb)       (0)
 #define nf_bridge_pad(skb)                     (0)
+#define br_drop_fake_rtable(skb)               (0)
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index ee64287f1290..e221f88ebb8d 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -47,6 +47,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
                kfree_skb(skb);
        } else {
                skb_push(skb, ETH_HLEN);
+               br_drop_fake_rtable(skb);
                dev_queue_xmit(skb);
        }
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa8b8f763580..e7dd46de1347 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -687,11 +687,7 @@ static unsigned int br_nf_local_in(unsigned int hook, 
struct sk_buff *skb,
                                   const struct net_device *out,
                                   int (*okfn)(struct sk_buff *))
 {
-       struct rtable *rt = skb_rtable(skb);
-
-       if (rt && rt == bridge_parent_rtable(in))
-               skb_dst_drop(skb);
-
+       br_drop_fake_rtable(skb);
        return NF_ACCEPT;
 }
 
-- 
1.7.10