@@ -36,6 +36,12 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
const unsigned char *dest;
u16 vid = 0;
+ /* clear all private fields after the bridge dev pointer */
+ BUILD_BUG_ON(offsetof(struct br_input_skb_cb, brdev) > 0);
+ memset(skb->cb + sizeof(struct net_device *),
+ 0,
+ sizeof(struct br_input_skb_cb) - sizeof(struct net_device *));
+
rcu_read_lock();
nf_ops = rcu_dereference(nf_br_ops);
if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {
@@ -50,7 +56,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
br_switchdev_frame_unmark(skb);
BR_INPUT_SKB_CB(skb)->brdev = dev;
- BR_INPUT_SKB_CB(skb)->frag_max_size = 0;
skb_reset_mac_header(skb);
skb_pull(skb, ETH_HLEN);
We need to clear all of the bridge private skb variables as they can be stale due to the packet having skb->cb initialized earlier and then transmitted through the bridge device. Similar memset is already done on bridge's input. We've seen cases where proxyarp_replied was 1 on routed multicast packets transmitted through the bridge to ports with neigh suppress and were getting dropped. Same thing can in theory happen with the port isolation bit as well. We clear only the struct part after the bridge pointer (currently 8 bytes) since the pointer is always set later. We can now remove the redundant zeroing of frag_max_size. Also add a BUILD_BUG_ON to make sure we catch any movement of the bridge dev pointer. Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppress arp and nd flood") Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> --- v2: clear only the second half of the struct which contains the fields that are used in various bridge parts, this replaced the rep stos instruction with a single movq on my x86 and in general reduces the clear area to 8 bytes, and in addition we can remove the now redundant zeroing of frag_max_size as it will be already cleared, add a build_bug_on to make sure we catch any movement of the bridge dev pointer net/bridge/br_device.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)