kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/bridge
History
Zhiling Zou daa6e070f8 netfilter: bridge: release template ct on non-IP path 
commit d45cc8020d upstream.

A bridge nftables ct zone set rule can attach a conntrack template to
an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6
EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with
IP_CT_UNTRACKED without releasing the existing template reference.

That makes the per-cpu template, and any temporary templates allocated
for concurrent use, unreachable and leaks memory until the host runs out
of slab.

Reset the skb conntrack state before marking the frame untracked so the
existing template reference is dropped on the non-IP path.

Fixes: 3c171f496e ("netfilter: bridge: add connection tracking system")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-19 17:14:17 +02:00
..
netfilter netfilter: bridge: release template ct on non-IP path 2026-08-19 17:14:17 +02:00
br.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-08-13 06:41:22 -07:00
br_arp_nd_proxy.c net: bridge: use a stable FDB dst snapshot in RCU readers 2026-06-19 13:33:41 +02:00
br_cfm.c bridge: cfm: reject invalid CCM interval at configuration time 2026-07-24 15:51:35 +02:00
br_cfm_netlink.c bridge: cfm: reject invalid CCM interval at configuration time 2026-07-24 15:51:35 +02:00
br_device.c net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled 2026-04-18 10:33:10 +02:00
br_fdb.c net: bridge: use a stable FDB dst snapshot in RCU readers 2026-06-19 13:33:41 +02:00
br_forward.c bridge: Redirect to backup port when port is administratively down 2025-12-07 06:09:19 +09:00
br_if.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-07-24 15:51:42 +02:00
br_input.c net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled 2026-04-18 10:33:10 +02:00
br_ioctl.c net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. 2026-01-19 13:10:11 +01:00
br_mdb.c net: bridge: vlan: account for router port lists when notifying 2021-08-17 10:37:29 +01:00
br_mrp.c net: bridge: mrp: fix uninitialised bytes on the wire 2026-08-19 17:14:15 +02:00
br_mrp_netlink.c bridge: mrp: Use hlist_head instead of list_head for mrp 2020-11-09 16:42:12 -08:00
br_mrp_switchdev.c bridge: mrp: Extend br_mrp_switchdev to detect better the errors 2021-02-16 14:47:46 -08:00
br_multicast.c net: bridge: stop fast-leave after deleting a port group 2026-08-19 17:14:10 +02:00
br_multicast_eht.c net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_netfilter_hooks.c netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm 2025-09-09 18:50:18 +02:00
br_netfilter_ipv6.c netfilter: br_netfilter: Drop dst references before setting. 2022-09-15 11:30:04 +02:00
br_netlink.c bridge/br_netlink.c: no need to return void function 2024-05-02 16:24:45 +02:00
br_netlink_tunnel.c net: bridge: vlan: fix vlan range dumps starting with pvid 2026-08-19 17:13:58 +02:00
br_nf_core.c bridge: netfilter: Fix forwarding of fragmented packets 2025-06-04 14:38:05 +02:00
br_private.h net: bridge: vlan: fix vlan range dumps starting with pvid 2026-08-19 17:13:58 +02:00
br_private_cfm.h bridge: cfm: Kernel space implementation of CFM. CCM frame RX added. 2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_private_mrp.h net: bridge: mrp: Update the Test frames for MRA 2021-06-28 15:46:10 -07:00
br_private_stp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
br_private_tunnel.h bridge: always declare tunnel functions 2023-05-24 17:36:52 +01:00
br_stp.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-07-24 15:51:42 +02:00
br_stp_bpdu.c net: bridge: add STP xstats 2019-12-14 20:02:36 -08:00
br_stp_if.c bridge: Add extack warning when enabling STP in netns. 2023-07-27 08:46:59 +02:00
br_stp_timer.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
br_switchdev.c net: bridge: Do not offload IGMP/MLD messages 2025-08-28 16:24:02 +02:00
br_sysfs_br.c net: bridge: mcast: add and enforce startup query interval minimum 2022-01-05 12:42:37 +01:00
br_sysfs_if.c net: bridge: mcast: br_multicast_set_port_router takes multicast context as argument 2021-08-20 15:00:35 +01:00
br_vlan.c net: bridge: vlan: fix vlan range dumps starting with pvid 2026-08-19 17:13:58 +02:00
br_vlan_options.c net: bridge: vlan: fix vlan range dumps starting with pvid 2026-08-19 17:13:58 +02:00
br_vlan_tunnel.c bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress 2026-01-19 13:10:16 +01:00
Kconfig bridge: cfm: Add BRIDGE_CFM to Kconfig. 2020-10-29 18:39:43 -07:00
Makefile net: bridge: multicast: add EHT host handling functions 2021-01-22 19:39:56 -08:00