linux/net/bridge
Nikolay Aleksandrov 9d332e69c1 net: bridge: fix vlan stats use-after-free on destruction
Syzbot reported a use-after-free of the global vlan context on port vlan
destruction. When I added per-port vlan stats I missed the fact that the
global vlan context can be freed before the per-port vlan rcu callback.
There're a few different ways to deal with this, I've chosen to add a
new private flag that is set only when per-port stats are allocated so
we can directly check it on destruction without dereferencing the global
context at all. The new field in net_bridge_vlan uses a hole.

v2: cosmetic change, move the check to br_process_vlan_info where the
    other checks are done
v3: add change log in the patch, add private (in-kernel only) flags in a
    hole in net_bridge_vlan struct and use that instead of mixing
    user-space flags with private flags

Fixes: 9163a0fc1f ("net: bridge: add support for per-port vlan stats")
Reported-by: syzbot+04681da557a0e49a52e5@syzkaller.appspotmail.com
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-17 21:38:44 -08:00
..
netfilter netfilter: bridge: Expose nf_tables bridge hook priorities through uapi 2018-08-03 21:15:09 +02:00
Kconfig docs: fix some broken documentation references 2018-09-20 11:09:53 -06:00
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
br.c bridge: switchdev: Allow clearing FDB entry offload indication 2018-10-17 17:45:08 -07:00
br_arp_nd_proxy.c net: bridge: convert neigh_suppress_enabled option to a bit 2018-09-26 10:04:23 -07:00
br_device.c netpoll: allow cleanup to be synchronous 2018-10-19 17:01:43 -07:00
br_fdb.c bridge: switchdev: Allow clearing FDB entry offload indication 2018-10-17 17:45:08 -07:00
br_forward.c net: bridge: add support for backup port 2018-07-23 09:32:15 -07:00
br_if.c net: bridge: convert mtu_set_by_user to a bit 2018-09-26 10:04:23 -07:00
br_input.c net: bridge: convert neigh_suppress_enabled option to a bit 2018-09-26 10:04:23 -07:00
br_ioctl.c net: bridge: add notifications for the bridge dev on vlan change 2017-11-02 15:53:40 +09:00
br_mdb.c net/bridge: Update br_mdb_dump for strict data checking 2018-10-08 10:39:05 -07:00
br_multicast.c net: bridge: remove ipv6 zero address check in mcast queries 2018-10-28 19:18:09 -07:00
br_netfilter_hooks.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-10-03 21:00:17 -07:00
br_netfilter_ipv6.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
br_netlink.c net: bridge: add support for per-port vlan stats 2018-10-12 10:18:58 -07:00
br_netlink_tunnel.c bridge: netlink: make setlink/dellink notifications more accurate 2017-10-29 11:03:43 +09:00
br_nf_core.c xfrm: Move dst->path into struct xfrm_dst 2017-11-30 09:54:26 -05:00
br_private.h net: bridge: fix vlan stats use-after-free on destruction 2018-11-17 21:38:44 -08:00
br_private_stp.h net: bridge: add helper to set topology change 2016-12-10 21:27:23 -05:00
br_private_tunnel.h bridge: netlink: make setlink/dellink notifications more accurate 2017-10-29 11:03:43 +09:00
br_stp.c net: bridge: add notifications for the bridge dev on vlan change 2017-11-02 15:53:40 +09:00
br_stp_bpdu.c net: introduce __skb_put_[zero, data, u8] 2017-06-20 13:30:14 -04:00
br_stp_if.c net: bridge: add notifications for the bridge dev on vlan change 2017-11-02 15:53:40 +09:00
br_stp_timer.c net: bridge: Convert timers to use timer_setup() 2017-11-03 15:42:49 +09:00
br_switchdev.c bridge: switchdev: Allow clearing FDB entry offload indication 2018-10-17 17:45:08 -07:00
br_sysfs_br.c net: bridge: add support for per-port vlan stats 2018-10-12 10:18:58 -07:00
br_sysfs_if.c net: bridge: add support for backup port 2018-07-23 09:32:15 -07:00
br_vlan.c net: bridge: fix vlan stats use-after-free on destruction 2018-11-17 21:38:44 -08:00
br_vlan_tunnel.c bridge: vlan_tunnel: explicitly reset metadata attrs to NULL on failure 2017-02-17 13:33:41 -05:00