diff options
author | Hong Zhiguo <zhiguohong@tencent.com> | 2013-09-14 18:42:28 +0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2013-09-16 06:03:33 +0400 |
commit | 716ec052d2280d511e10e90ad54a86f5b5d4dcc2 (patch) | |
tree | d1746e5302a4bfcd86d1155e0f4882b0b8e07fa4 /drivers | |
parent | 1fb1754a8c70d69ab480763c423e0a74369c4a67 (diff) | |
download | linux-716ec052d2280d511e10e90ad54a86f5b5d4dcc2.tar.xz |
bridge: fix NULL pointer deref of br_port_get_rcu
The NULL deref happens when br_handle_frame is called between these
2 lines of del_nbp:
dev->priv_flags &= ~IFF_BRIDGE_PORT;
/* --> br_handle_frame is called at this time */
netdev_rx_handler_unregister(dev);
In br_handle_frame the return of br_port_get_rcu(dev) is dereferenced
without check but br_port_get_rcu(dev) returns NULL if:
!(dev->priv_flags & IFF_BRIDGE_PORT)
Eric Dumazet pointed out the testing of IFF_BRIDGE_PORT is not necessary
here since we're in rcu_read_lock and we have synchronize_net() in
netdev_rx_handler_unregister. So remove the testing of IFF_BRIDGE_PORT
and by the previous patch, make sure br_port_get_rcu is called in
bridging code.
Signed-off-by: Hong Zhiguo <zhiguohong@tencent.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions