Commit 716ec052 authored by Hong Zhiguo's avatar Hong Zhiguo Committed by David S. Miller

bridge: fix NULL pointer deref of br_port_get_rcu

The NULL deref happens when br_handle_frame is called between these
2 lines of del_nbp:
	dev->priv_flags &= ~IFF_BRIDGE_PORT;
	/* --> br_handle_frame is called at this time */
	netdev_rx_handler_unregister(dev);

In br_handle_frame the return of br_port_get_rcu(dev) is dereferenced
without check but br_port_get_rcu(dev) returns NULL if:
	!(dev->priv_flags & IFF_BRIDGE_PORT)

Eric Dumazet pointed out the testing of IFF_BRIDGE_PORT is not necessary
here since we're in rcu_read_lock and we have synchronize_net() in
netdev_rx_handler_unregister. So remove the testing of IFF_BRIDGE_PORT
and by the previous patch, make sure br_port_get_rcu is called in
bridging code.
Signed-off-by: default avatarHong Zhiguo <zhiguohong@tencent.com>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1fb1754a
...@@ -202,10 +202,7 @@ struct net_bridge_port ...@@ -202,10 +202,7 @@ struct net_bridge_port
static inline struct net_bridge_port *br_port_get_rcu(const struct net_device *dev) static inline struct net_bridge_port *br_port_get_rcu(const struct net_device *dev)
{ {
struct net_bridge_port *port = return rcu_dereference(dev->rx_handler_data);
rcu_dereference_rtnl(dev->rx_handler_data);
return br_port_exists(dev) ? port : NULL;
} }
static inline struct net_bridge_port *br_port_get_rtnl(const struct net_device *dev) static inline struct net_bridge_port *br_port_get_rtnl(const struct net_device *dev)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment