[Devel] [PATCH RHEL7 COMMIT] neighbour: purge nf_bridged skb from foreign device neigh

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1160.105.1.vz7.214.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.105.1.vz7.214.2
------>
commit d0599bd2398c0b078eb058ed204db76e723b4245
Author: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
Date:   Mon Jan 8 11:43:41 2024 +0800

    neighbour: purge nf_bridged skb from foreign device neigh
    
    An skb can be added to a neigh->arp_queue while waiting for an arp
    reply. Where original skb's skb->dev can be different to neigh's
    neigh->dev. For instance in case of bridging dnated skb from one veth to
    another, the skb would be added to a neigh->arp_queue of the bridge.
    
    There is no explicit mechanism that prevents the original skb->dev link
    of such skb from being freed under us. For instance neigh_flush_dev does
    not cleanup skbs from different device's neigh queue. But that original
    link can be used and lead to crash on e.g. this stack:
    
    arp_process
      neigh_update
        skb = __skb_dequeue(&neigh->arp_queue)
          neigh_resolve_output(..., skb)
            ...
              br_nf_dev_xmit
                br_nf_pre_routing_finish_bridge_slow
                  skb->dev = nf_bridge->physindev
                  br_handle_frame_finish
    
    So let's improve neigh_flush_dev to also purge skbs when device
    equal to their skb->nf_bridge->physindev gets destroyed.
    
    https://virtuozzo.atlassian.net/browse/PSBM-151735
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 net/core/neighbour.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index d5b28c158144..e3b0f451943e 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -43,6 +43,10 @@
 #include <net/addrconf.h>
 #include <bc/beancounter.h>
 
+#include <linux/skbuff.h>
+#include <linux/netfilter.h>
+#include <net/netfilter/br_netfilter.h>
+
 #define DEBUG
 #define NEIGH_DEBUG 1
 #define neigh_dbg(level, fmt, ...)		\
@@ -257,6 +261,28 @@ static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net)
 	}
 }
 
+static void neigh_purge_nf_bridge_dev(struct neighbour *neigh, struct net_device *dev)
+{
+	struct sk_buff_head *list = &neigh->arp_queue;
+	struct nf_bridge_info *nf_bridge;
+	struct sk_buff *skb, *next;
+
+	write_lock(&neigh->lock);
+	skb = skb_peek(list);
+	while (skb) {
+		nf_bridge = nf_bridge_info_get(skb);
+
+		next = skb_peek_next(skb, list);
+		if (nf_bridge && nf_bridge->physindev == dev) {
+			__skb_unlink(skb, list);
+			neigh->arp_queue_len_bytes -= skb->truesize;
+			kfree_skb(skb);
+		}
+		skb = next;
+	}
+	write_unlock(&neigh->lock);
+}
+
 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 {
 	int i;
@@ -272,6 +298,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 		while ((n = rcu_dereference_protected(*np,
 					lockdep_is_held(&tbl->lock))) != NULL) {
 			if (dev && n->dev != dev) {
+				neigh_purge_nf_bridge_dev(n, dev);
 				np = &n->next;
 				continue;
 			}