summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHong Zhiguo <zhiguohong@tencent.com>2013-09-14 18:42:28 +0400
committerDavid S. Miller <davem@davemloft.net>2013-09-16 06:03:33 +0400
commit716ec052d2280d511e10e90ad54a86f5b5d4dcc2 (patch)
treed1746e5302a4bfcd86d1155e0f4882b0b8e07fa4
parent1fb1754a8c70d69ab480763c423e0a74369c4a67 (diff)
downloadlinux-716ec052d2280d511e10e90ad54a86f5b5d4dcc2.tar.xz
bridge: fix NULL pointer deref of br_port_get_rcu
The NULL deref happens when br_handle_frame is called between these 2 lines of del_nbp: dev->priv_flags &= ~IFF_BRIDGE_PORT; /* --> br_handle_frame is called at this time */ netdev_rx_handler_unregister(dev); In br_handle_frame the return of br_port_get_rcu(dev) is dereferenced without check but br_port_get_rcu(dev) returns NULL if: !(dev->priv_flags & IFF_BRIDGE_PORT) Eric Dumazet pointed out the testing of IFF_BRIDGE_PORT is not necessary here since we're in rcu_read_lock and we have synchronize_net() in netdev_rx_handler_unregister. So remove the testing of IFF_BRIDGE_PORT and by the previous patch, make sure br_port_get_rcu is called in bridging code. Signed-off-by: Hong Zhiguo <zhiguohong@tencent.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/bridge/br_private.h5
1 files changed, 1 insertions, 4 deletions
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index dd583177cba4..efb57d911569 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -202,10 +202,7 @@ struct net_bridge_port
static inline struct net_bridge_port *br_port_get_rcu(const struct net_device *dev)
{
- struct net_bridge_port *port =
- rcu_dereference_rtnl(dev->rx_handler_data);
-
- return br_port_exists(dev) ? port : NULL;
+ return rcu_dereference(dev->rx_handler_data);
}
static inline struct net_bridge_port *br_port_get_rtnl(const struct net_device *dev)