nf_ct_bridge_refrag() warns when skb->protocol is neither IPv4 nor IPv6. A vlan filtering bridge can get there with a vlan ethertype: if the protocol of the tag of a frame differs from the vlan_protocol of the bridge, br_allowed_ingress() moves the tag back into the packet after NF_BR_PRE_ROUTING, where bridge conntrack has already defragmented it.
Anyone who can send fragments into a port of such a bridge can trigger the warning, which takes the machine down with panic_on_warn. The packet is dropped either way, so only warn on kernels built with CONFIG_DEBUG_NET. This only avoids the warning. Such fragmented packets are still dropped. syzbot reported the warning. It keeps triggering on CONFIG_DEBUG_NET kernels until the vlan tag is handled, which is left for a follow-up: https://syzkaller.appspot.com/bug?extid=a8ba738fe2db6b4bb27f Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system") Assisted-by: LLM Signed-off-by: Laveesh Bansal <[email protected]> --- v2: - Reduced to DEBUG_NET_WARN_ON_ONCE(), as suggested by Pablo. Handling the vlan tag and the selftest will follow for nf-next. - Dropped Reported-by, Closes and Cc: stable. This does not fix the syzbot report, its config has CONFIG_DEBUG_NET=y. - Only the commit that added the warning is listed in Fixes:. v1: https://lore.kernel.org/r/[email protected] net/bridge/netfilter/nf_conntrack_bridge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c index b5444335b86f..8c83dc05114b 100644 --- a/net/bridge/netfilter/nf_conntrack_bridge.c +++ b/net/bridge/netfilter/nf_conntrack_bridge.c @@ -358,7 +358,7 @@ nf_ct_bridge_refrag(struct sk_buff *skb, const struct nf_hook_state *state, nf_br_ip6_fragment(state->net, state->sk, skb, &data, output); break; default: - WARN_ON_ONCE(1); + DEBUG_NET_WARN_ON_ONCE(1); return NF_DROP; } -- 2.43.0
