target/linux/generic/backport-5.4/610-v5.9-net-bridge-clear-bridge-s-private-skb-space-on-xmit.patch

   1 From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
   2 Date: Fri, 31 Jul 2020 19:26:16 +0300
   3 Subject: [PATCH] net: bridge: clear bridge's private skb space on xmit
   4
   5 We need to clear all of the bridge private skb variables as they can be
   6 stale due to the packet being recirculated through the stack and then
   7 transmitted through the bridge device. Similar memset is already done on
   8 bridge's input. We've seen cases where proxyarp_replied was 1 on routed
   9 multicast packets transmitted through the bridge to ports with neigh
  10 suppress which were getting dropped. Same thing can in theory happen with
  11 the port isolation bit as well.
  12
  13 Fixes: 821f1b21cabb ("bridge: add new BR_NEIGH_SUPPRESS port flag to suppress arp and nd flood")
  14 Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
  15 Signed-off-by: David S. Miller <davem@davemloft.net>
  16 ---
  17
  18 --- a/net/bridge/br_device.c
  19 +++ b/net/bridge/br_device.c
  20 @@ -36,6 +36,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *
  21         struct ethhdr *eth;
  22         u16 vid = 0;
  23
  24 +       memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
  25 +
  26         rcu_read_lock();
  27         nf_ops = rcu_dereference(nf_br_ops);
  28         if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {