Re: [BUG] net/bridge: out-of-bounds in br_forward()

[Florian Westphal]

co <co+63bad23bb3b4cd85@xxxxxxx> wrote:
> We found a bug reachable in:
> 
>     path    net/bridge/netfilter
>     crash   out-of-bounds in br_forward()
>     commit  7b5344954050 ("Merge tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf")

I'm looking into these reports, I think this is the same
underlying bug as the other report; a variant of

ccb9fd4b8753 ("netfilter: revalidate bridge ports")

That bug uses nfnetlink_queue for RCU escape, the other two reports
use defrag engine.

And sure, its br_netfilter again -- I think we will have to consider
removing it even though it will break existing setups.

As a compromise, I suggest to reject br_netfilter in user namespaces,
i.e. call_iptables cannot be enabled anymore unless you have
CAP_NET_ADMIN in init net.