summaryrefslogtreecommitdiff
path: root/net/bridge/br_ioctl.c
diff options
context:
space:
mode:
authorNikolay Aleksandrov <razor@blackwall.org>2015-06-15 20:28:51 +0300
committerDavid S. Miller <davem@davemloft.net>2015-06-18 13:29:47 +0300
commit2dab80a8b486f02222a69daca6859519e05781d9 (patch)
treead530475217a5b3924aba3efa33125c345cf0a80 /net/bridge/br_ioctl.c
parentac0a72a3e6e8d817f60ce4d9a8f3b43dc256d847 (diff)
downloadlinux-2dab80a8b486f02222a69daca6859519e05781d9.tar.xz
bridge: fix br_stp_set_bridge_priority race conditions
After the ->set() spinlocks were removed br_stp_set_bridge_priority was left running without any protection when used via sysfs. It can race with port add/del and could result in use-after-free cases and corrupted lists. Tested by running port add/del in a loop with stp enabled while setting priority in a loop, crashes are easily reproducible. The spinlocks around sysfs ->set() were removed in commit: 14f98f258f19 ("bridge: range check STP parameters") There's also a race condition in the netlink priority support that is fixed by this change, but it was introduced recently and the fixes tag covers it, just in case it's needed the commit is: af615762e972 ("bridge: add ageing_time, stp_state, priority over netlink") Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Fixes: 14f98f258f19 ("bridge: range check STP parameters") Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge/br_ioctl.c')
-rw-r--r--net/bridge/br_ioctl.c2
1 files changed, 0 insertions, 2 deletions
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index a9a4a1b7863d..8d423bc649b9 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
return -EPERM;
- spin_lock_bh(&br->lock);
br_stp_set_bridge_priority(br, args[1]);
- spin_unlock_bh(&br->lock);
return 0;
case BRCTL_SET_PORT_PRIORITY: