Re: [PATCH] netfilter: fix dangling pointer access of fake_rtable

[Rundong Ge]

br_nf_pre_routing will call the NF_INET_PRE_ROUTING hooks, at this
time both entry->state.in and entry->state.out are not bridge device.

NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
skb->dev, NULL,
br_nf_pre_routing_finish);

Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> ä2019å4æ22æåä äå4:34åéï
>
> On Tue, Apr 09, 2019 at 06:56:12AM +0000, Rundong Ge wrote:
> [...]
> > diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
> > index 0dcc359..57eb02d 100644
> > --- a/net/netfilter/nfnetlink_queue.c
> > +++ b/net/netfilter/nfnetlink_queue.c
> > @@ -905,13 +905,25 @@ static void free_entry(struct nf_queue_entry *entry)
> >  dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
> >  {
> >  #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
> > -     int physinif, physoutif;
> > +     struct net_device *physindev, *physoutdev;
> > +     struct net_bridge_port *port;
> >
> > -     physinif = nf_bridge_get_physinif(entry->skb);
> > -     physoutif = nf_bridge_get_physoutif(entry->skb);
> > -
> > -     if (physinif == ifindex || physoutif == ifindex)
> > -             return 1;
> > +     physindev = nf_bridge_get_physindev(entry->skb);
> > +     physoutdev = nf_bridge_get_physoutdev(entry->skb);
> > +     if (physindev) {
> > +             if (physindev->ifindex == ifindex)
> > +                     return 1;
> > +             port = br_port_get_rcu(physindev);
> > +             if (port && port->br->dev->ifindex == ifindex)
> > +                     return 1;
> > +     }
> > +     if (physoutdev) {
> > +             if (physoutdev->ifindex == ifindex)
> > +                     return 1;
> > +             port = br_port_get_rcu(physoutdev);
> > +             if (port && port->br->dev->ifindex == ifindex)
> > +                     return 1;
> > +     }
>
> Either entry->state.in and entry->state.out point to the bridge
> device, after this #endif.
>
> >  #endif
> >       if (entry->state.in)
> >               if (entry->state.in->ifindex == ifindex)
> > --
> > 1.8.3.1
> >