diff options
| author | Hong Zhiguo <zhiguohong@tencent.com> | 2013-09-14 22:42:28 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-10-13 18:14:25 -0700 |
| commit | 120edba7e46f928b7fd13b40ede405bbd6a1b290 (patch) | |
| tree | 388f75e63385c9c708b7f9aac8938839065c1cc0 /net | |
| parent | 6a0cacf7e1ddc3669019f260ab86f11024a73ce3 (diff) | |
bridge: fix NULL pointer deref of br_port_get_rcu
[ Upstream commit 716ec052d2280d511e10e90ad54a86f5b5d4dcc2 ]
The NULL deref happens when br_handle_frame is called between these
2 lines of del_nbp:
dev->priv_flags &= ~IFF_BRIDGE_PORT;
/* --> br_handle_frame is called at this time */
netdev_rx_handler_unregister(dev);
In br_handle_frame the return of br_port_get_rcu(dev) is dereferenced
without check but br_port_get_rcu(dev) returns NULL if:
!(dev->priv_flags & IFF_BRIDGE_PORT)
Eric Dumazet pointed out the testing of IFF_BRIDGE_PORT is not necessary
here since we're in rcu_read_lock and we have synchronize_net() in
netdev_rx_handler_unregister. So remove the testing of IFF_BRIDGE_PORT
and by the previous patch, make sure br_port_get_rcu is called in
bridging code.
Signed-off-by: Hong Zhiguo <zhiguohong@tencent.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bridge/br_private.h | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index 098454fa2ab..cde1eb14d9a 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -202,10 +202,7 @@ struct net_bridge_port static inline struct net_bridge_port *br_port_get_rcu(const struct net_device *dev) { - struct net_bridge_port *port = - rcu_dereference_rtnl(dev->rx_handler_data); - - return br_port_exists(dev) ? port : NULL; + return rcu_dereference(dev->rx_handler_data); } static inline struct net_bridge_port *br_port_get_rtnl(const struct net_device *dev) |