kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info
JIRA: https://issues.redhat.com/browse/RHEL-37040 JIRA: https://issues.redhat.com/browse/RHEL-37041 CVE: CVE-2024-35839
nf_bridge->physindev stores dev pointer without holding reference, so if skb gets queued somewhere and device disappears further access results in UaF.
Store device ifindex instead and re-lookup, its less intrusive and error prone than adding refcounting.
Signed-off-by: Florian Westphal fwestpha@redhat.com
Edited by Florian Westphal