diff options
| author | Nikolay Aleksandrov <nikolay@cumulusnetworks.com> | 2018-11-16 17:50:01 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-11-18 06:38:44 +0100 |
| commit | 9d332e69c1dc74dcd748de7cbd2dac5c61bda265 (patch) | |
| tree | 912c15036f8f473ddbf7526c4c9b4763c18f164f /include | |
| parent | socket: do a generic_file_splice_read when proto_ops has no splice_read (diff) | |
| download | linux-9d332e69c1dc74dcd748de7cbd2dac5c61bda265.tar.xz linux-9d332e69c1dc74dcd748de7cbd2dac5c61bda265.zip | |
net: bridge: fix vlan stats use-after-free on destruction
Syzbot reported a use-after-free of the global vlan context on port vlan
destruction. When I added per-port vlan stats I missed the fact that the
global vlan context can be freed before the per-port vlan rcu callback.
There're a few different ways to deal with this, I've chosen to add a
new private flag that is set only when per-port stats are allocated so
we can directly check it on destruction without dereferencing the global
context at all. The new field in net_bridge_vlan uses a hole.
v2: cosmetic change, move the check to br_process_vlan_info where the
other checks are done
v3: add change log in the patch, add private (in-kernel only) flags in a
hole in net_bridge_vlan struct and use that instead of mixing
user-space flags with private flags
Fixes: 9163a0fc1f0c ("net: bridge: add support for per-port vlan stats")
Reported-by: syzbot+04681da557a0e49a52e5@syzkaller.appspotmail.com
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions