bridge: netfilter: Fix forwarding of fragmented packets

JIRA: https://issues.redhat.com/browse/RHEL-75594

commit 91b6dbc
Author: Ido Schimmel <idosch@nvidia.com>
Date:   Thu May 15 11:48:48 2025 +0300

    bridge: netfilter: Fix forwarding of fragmented packets

    When netfilter defrag hooks are loaded (due to the presence of conntrack
    rules, for example), fragmented packets entering the bridge will be
    defragged by the bridge's pre-routing hook (br_nf_pre_routing() ->
    ipv4_conntrack_defrag()).

    Later on, in the bridge's post-routing hook, the defragged packet will
    be fragmented again. If the size of the largest fragment is larger than
    what the kernel has determined as the destination MTU (using
    ip_skb_dst_mtu()), the defragged packet will be dropped.

    Before commit ac6627a ("net: ipv4: Consolidate ipv4_mtu and
    ip_dst_mtu_maybe_forward"), ip_skb_dst_mtu() would return dst_mtu() as
    the destination MTU. Assuming the dst entry attached to the packet is
    the bridge's fake rtable one, this would simply be the bridge's MTU (see
    fake_mtu()).

    However, after above mentioned commit, ip_skb_dst_mtu() ends up
    returning the route's MTU stored in the dst entry's metrics. Ideally, in
    case the dst entry is the bridge's fake rtable one, this should be the
    bridge's MTU as the bridge takes care of updating this metric when its
    MTU changes (see br_change_mtu()).

    Unfortunately, the last operation is a no-op given the metrics attached
    to the fake rtable entry are marked as read-only. Therefore,
    ip_skb_dst_mtu() ends up returning 1500 (the initial MTU value) and
    defragged packets are dropped during fragmentation when dealing with
    large fragments and high MTU (e.g., 9k).

    Fix by moving the fake rtable entry's metrics to be per-bridge (in a
    similar fashion to the fake rtable entry itself) and marking them as
    writable, thereby allowing MTU changes to be reflected.

    Fixes: 62fa8a8 ("net: Implement read-only protection and COW'ing of metrics.")
    Fixes: 33eb987 ("bridge: initialize fake_rtable metrics")
    Reported-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
    Closes: https://lore.kernel.org/netdev/PH0PR10MB4504888284FF4CBA648197D0ACB82@PH0PR10MB4504.namprd10.prod.outlook.com/
    Tested-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
    Signed-off-by: Ido Schimmel <idosch@nvidia.com>
    Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
    Link: https://patch.msgid.link/20250515084848.727706-1-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Mohammad Heib <mheib@redhat.com>

Author: mohammadheib

net/bridge/br_nf_core.c

@@ -65,17 +65,14 @@ static struct dst_ops fake_dst_ops = {
  * ipt_REJECT needs it.  Future netfilter modules might
  * require us to fill additional fields.
  */
-static const u32 br_dst_default_metrics[RTAX_MAX] = {
-	[RTAX_MTU - 1] = 1500,
-};
-
 void br_netfilter_rtable_init(struct net_bridge *br)
 {
 	struct rtable *rt = &br->fake_rtable;
 
 	rcuref_init(&rt->dst.__rcuref, 1);
 	rt->dst.dev = br->dev;
-	dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
+	dst_init_metrics(&rt->dst, br->metrics, false);
+	dst_metric_set(&rt->dst, RTAX_MTU, br->dev->mtu);
 	rt->dst.flags	= DST_NOXFRM | DST_FAKE_RTABLE;
 	rt->dst.ops = &fake_dst_ops;
 }

net/bridge/br_private.h

@@ -507,6 +507,7 @@ struct net_bridge {
 		struct rtable		fake_rtable;
 		struct rt6_info		fake_rt6_info;
 	};
+	u32				metrics[RTAX_MAX];
 #endif
 	u16				group_fwd_mask;
 	u16				group_fwd_mask_required;