在 2025/8/20 19:31, Florian Westphal 写道:
Wang Liang <wangliang74@xxxxxxxxxx> wrote:
Previous commit 2d72afb34065 ("netfilter: nf_conntrack: fix crash due to
removal of uninitialised entry") move the IPS_CONFIRMED assignment after
the hash table insertion.
How is that related to this change?
As you write below, the bug came in with 62e7151ae3eb.
Before the commit 2d72afb34065, __nf_conntrack_confirm() set
'ct->status |= IPS_CONFIRMED;' before check hash, the warning will not
happen, so I put it here.
As you say, the bug came in with 62e7151ae3eb. I will delete this paragraph
in next patch.
To solve the hash conflict, nf_ct_resolve_clash() try to merge the
conntracks, and update skb->_nfct. However, br_nf_local_in() still use the
old ct from local variable 'nfct' after confirm(), which leads to this
issue. Fix it by rereading nfct from skb.
Fixes: 62e7151ae3eb ("netfilter: bridge: confirm multicast packets before passing them up the stack")
Signed-off-by: Wang Liang <wangliang74@xxxxxxxxxx>
---
net/bridge/br_netfilter_hooks.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 94cbe967d1c1..55b1b7dcb609 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -626,6 +626,7 @@ static unsigned int br_nf_local_in(void *priv,
break;
}
+ nfct = skb_nfct(skb);
ct = container_of(nfct, struct nf_conn, ct_general);
WARN_ON_ONCE(!nf_ct_is_confirmed(ct));
There is a second bug here, confirm can return NF_DROP and
nfct will be NULL.
Thanks for your suggestion!
Do you mean that ct may be deleted in confirm and return NF_DROP, so we can
not visit it in br_nf_local_in() and need to add 'case NF_DROP:' here?
I cannot find somewhere set skb->_nfct to NULL and return NF_DROP. Can you
give some hints?
------
Best regards
Wang Liang
Can you make this change too? (or something similar)?
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 94cbe967d1c1..69b7b7c7565e 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -619,8 +619,9 @@ static unsigned int br_nf_local_in(void *priv,
nf_bridge_pull_encap_header(skb);
ret = ct_hook->confirm(skb);
switch (ret & NF_VERDICT_MASK) {
+ case NF_DROP:
case NF_STOLEN:
- return NF_STOLEN;
+ return ret;
nfct reload seems correct, thanks for catching this.
