github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.2
linux/net/bridge
History
Zhiling Zou d45cc8020d netfilter: bridge: release template ct on non-IP path 
A bridge nftables ct zone set rule can attach a conntrack template to
an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6
EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with
IP_CT_UNTRACKED without releasing the existing template reference.

That makes the per-cpu template, and any temporary templates allocated
for concurrent use, unreachable and leaks memory until the host runs out
of slab.

Reset the skb conntrack state before marking the frame untracked so the
existing template reference is dropped on the non-IP path.

Fixes: 3c171f496e ("netfilter: bridge: add connection tracking system")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10 20:14:01 +02:00
..
netfilter netfilter: bridge: release template ct on non-IP path 2026-08-10 20:14:01 +02:00
br_arp_nd_proxy.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_cfm_netlink.c bridge: cfm: reject invalid CCM interval at configuration time 2026-06-11 15:16:12 -07:00
br_cfm.c bridge: cfm: reject invalid CCM interval at configuration time 2026-06-11 15:16:12 -07:00
br_device.c bridge: Add missing READ_ONCE() annotations around FDB destination port 2026-05-19 18:13:01 -07:00
br_fdb.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_forward.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_if.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-06-30 15:14:35 +02:00
br_input.c net: bridge: use atomic ops to read/change p->flags (II) 2026-06-12 18:03:46 -07:00
br_ioctl.c bridge: provide lockless access to p->config_pending 2026-06-05 17:46:18 -07:00
br_mdb.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
br_mrp_netlink.c net: bridge: use atomic ops to read/change p->flags (II) 2026-06-12 18:03:46 -07:00
br_mrp_switchdev.c bridge: mrp: Extend br_mrp_switchdev to detect better the errors 2021-02-16 14:47:46 -08:00
br_mrp.c net: bridge: mrp: fix uninitialised bytes on the wire 2026-07-31 16:31:16 -07:00
br_mst.c net: bridge: fix MST static key usage 2025-11-06 07:32:17 -08:00
br_multicast_eht.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
br_multicast.c net: bridge: stop fast-leave after deleting a port group 2026-07-27 15:20:27 -07:00
br_netfilter_hooks.c netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() 2026-05-16 13:22:50 +02:00
br_netfilter_ipv6.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
br_netlink_tunnel.c net: bridge: vlan: fix vlan range dumps starting with pvid 2026-07-22 10:23:18 -07:00
br_netlink.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_nf_core.c bridge: netfilter: Fix forwarding of fragmented packets 2025-05-16 16:02:06 -07:00
br_private_cfm.h bridge: cfm: Kernel space implementation of CFM. CCM frame RX added. 2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_private_mrp.h net: bridge: mrp: Update the Test frames for MRA 2021-06-28 15:46:10 -07:00
br_private_stp.h
br_private_tunnel.h bridge: always declare tunnel functions 2023-05-17 21:28:58 -07:00
br_private.h net: bridge: vlan: fix vlan range dumps starting with pvid 2026-07-22 10:23:18 -07:00
br_stp_bpdu.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_stp_if.c bridge: provide lockless access to p->config_pending 2026-06-05 17:46:18 -07:00
br_stp_timer.c bridge: add a READ_ONCE() in br_timer_value() 2026-06-05 17:46:16 -07:00
br_stp.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-06-30 15:14:35 +02:00
br_switchdev.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_sysfs_br.c mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
br_sysfs_if.c bridge: use atomic ops to read/change p->flags in sysfs 2026-06-12 18:03:45 -07:00
br_vlan_options.c net: bridge: vlan: fix vlan range dumps starting with pvid 2026-07-22 10:23:18 -07:00
br_vlan_tunnel.c bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress 2026-01-04 09:45:35 -08:00
br_vlan.c net: bridge: vlan: fix vlan range dumps starting with pvid 2026-07-22 10:23:18 -07:00
br.c net: remove unused ATM protocols and legacy ATM device drivers 2026-04-23 12:21:14 -07:00
Kconfig ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs 2026-03-29 11:21:22 -07:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00