Packets locally delivered by the bridge are re-injected into the receive path via br_pass_frame_up() -> br_netif_receive_skb() -> netif_receive_skb() with skb->dev set to the bridge device. If the bridge device has an XDP program attached, __netif_receive_skb_core() runs do_xdp_generic() a second time on such packets.
A locally-delivered packet that was allocated on the TX path (e.g. an MLD packet built by mld_newpack()) does not carry the XDP_PACKET_HEADROOM that generic XDP requires, so netif_skb_check_for_xdp() calls pskb_expand_head() and reallocates the skb head buffer. This frees the head that the bridge rx path (br_handle_frame() / br_handle_frame_finish()) is still using, leading to a use-after-free read in br_handle_frame(): BUG: KASAN: slab-use-after-free in is_multicast_ether_addr [inline] BUG: KASAN: slab-use-after-free in is_valid_ether_addr [inline] BUG: KASAN: slab-use-after-free in br_handle_frame+0xcfb/0x1510 net/bridge/br_input.c:349 netif_receive_generic_xdp() already refuses to run generic XDP on reinjected packets by checking skb_is_redirected(). Reuse that marker: set it right before the bridge re-injects the packet, so generic XDP is skipped and the head buffer is left intact. Reported-by: [email protected] Link: https://lore.kernel.org/all/[email protected]/T/ Signed-off-by: Zhao ShiRong <[email protected]> --- net/bridge/br_input.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c @@ -26,6 +26,12 @@ static int br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb) { br_drop_fake_rtable(skb); + + /* Re-injected for local delivery: do not let generic XDP run on the + * bridge device a second time, it could reallocate the head via + * pskb_expand_head() and free a buffer still in use. + */ + skb_set_redirected_noclear(skb, false); return netif_receive_skb(skb); } -- 2.43.0
