From patchwork Tue Jul 2 12:00:18 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 1126228 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=cumulusnetworks.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="FgSKNCNf"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45dNGd11n6z9sLt for ; Tue, 2 Jul 2019 22:05:13 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726765AbfGBMFH (ORCPT ); Tue, 2 Jul 2019 08:05:07 -0400 Received: from mail-wr1-f66.google.com ([209.85.221.66]:45641 "EHLO mail-wr1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725767AbfGBMFG (ORCPT ); Tue, 2 Jul 2019 08:05:06 -0400 Received: by mail-wr1-f66.google.com with SMTP id f9so17459903wre.12 for ; Tue, 02 Jul 2019 05:05:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=1aZEj/XCFsNFlFULEN7f1Rmy+NlhgPUJTIq2bg1ycGU=; b=FgSKNCNfimG49RUeCXL6WnGtsCmjinJa964ufUQzJKCszetF4yVxNyWh20cvQNdIHF It7+LXtIHBeCW76WGc7Bob3w2PaZpQ+5xWZ42uFtN3VCbC1GaMarc+WH5hLFy2RUrsil rVBpjY9yoJPav+4dBhrrV8ApoEVxmubLu1PSQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=1aZEj/XCFsNFlFULEN7f1Rmy+NlhgPUJTIq2bg1ycGU=; b=Kii9XLLQMkCRz8mxvrDIwTm8/uJ2IqW4B2iWnt/2TzXIAk5udxORhfYDt9T5eUcJZv 9qlAMEQZ141ruRtDGEUN1uq797Ef9Z5nQYXB5VmNUe6CPLxQILNilLIVTm1ydSZ/lP8A apGjVjZHunvZ+kx+VNrLKdI+yHVNkqam0ANykS4cnNgyQBc0Fjw69F2w+dS/D7Wiywf9 OUCTScS3Rhjju6wsP8oCwlutI+7VKOUPf3iMH6nJX9yyf/pJDWNPpbTWTY5ag5hY+2gV NujPodXqPc8L4PlBOJg/9nK8jHXSjtsguu2P1JckoZMfbqd9RS+lS2YVVjt3D0LcjtH4 +oeQ== X-Gm-Message-State: APjAAAXsvJGnFtu7FtPbRMYER71YO1ofNtD97UcX6YC0i8ToU+bU/nDG MYA/lxG5k/HdGqaz4V2dq78dKJWkJfY= X-Google-Smtp-Source: APXvYqzzYLBakfoi7sbUJLZIiAE7f3XgIQ5bT05++eOYUGKeqMQ+nm/qSiPfkXaibjM4A5dOavV1YA== X-Received: by 2002:a5d:5186:: with SMTP id k6mr25315886wrv.30.1562069103095; Tue, 02 Jul 2019 05:05:03 -0700 (PDT) Received: from localhost.localdomain (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id x5sm2542655wmf.33.2019.07.02.05.05.02 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Tue, 02 Jul 2019 05:05:02 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: roopa@cumulusnetworks.com, davem@davemloft.net, martin@linuxlounge.net, bridge@lists.linux-foundation.org, yoshfuji@linux-ipv6.org, Nikolay Aleksandrov Subject: [PATCH net 1/4] net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling Date: Tue, 2 Jul 2019 15:00:18 +0300 Message-Id: <20190702120021.13096-2-nikolay@cumulusnetworks.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190702120021.13096-1-nikolay@cumulusnetworks.com> References: <20190702120021.13096-1-nikolay@cumulusnetworks.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org We take a pointer to grec prior to calling pskb_may_pull and use it afterwards to get nsrcs so record nsrcs before the pull when handling igmp3 and we get a pointer to nsrcs and call pskb_may_pull when handling mld2 which again could lead to reading 2 bytes out-of-bounds. ================================================================== BUG: KASAN: use-after-free in br_multicast_rcv+0x480c/0x4ad0 [bridge] Read of size 2 at addr ffff8880421302b4 by task ksoftirqd/1/16 CPU: 1 PID: 16 Comm: ksoftirqd/1 Tainted: G OE 5.2.0-rc6+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0x71/0xab print_address_description+0x6a/0x280 ? br_multicast_rcv+0x480c/0x4ad0 [bridge] __kasan_report+0x152/0x1aa ? br_multicast_rcv+0x480c/0x4ad0 [bridge] ? br_multicast_rcv+0x480c/0x4ad0 [bridge] kasan_report+0xe/0x20 br_multicast_rcv+0x480c/0x4ad0 [bridge] ? br_multicast_disable_port+0x150/0x150 [bridge] ? ktime_get_with_offset+0xb4/0x150 ? __kasan_kmalloc.constprop.6+0xa6/0xf0 ? __netif_receive_skb+0x1b0/0x1b0 ? br_fdb_update+0x10e/0x6e0 [bridge] ? br_handle_frame_finish+0x3c6/0x11d0 [bridge] br_handle_frame_finish+0x3c6/0x11d0 [bridge] ? br_pass_frame_up+0x3a0/0x3a0 [bridge] ? virtnet_probe+0x1c80/0x1c80 [virtio_net] br_handle_frame+0x731/0xd90 [bridge] ? select_idle_sibling+0x25/0x7d0 ? br_handle_frame_finish+0x11d0/0x11d0 [bridge] __netif_receive_skb_core+0xced/0x2d70 ? virtqueue_get_buf_ctx+0x230/0x1130 [virtio_ring] ? do_xdp_generic+0x20/0x20 ? virtqueue_napi_complete+0x39/0x70 [virtio_net] ? virtnet_poll+0x94d/0xc78 [virtio_net] ? receive_buf+0x5120/0x5120 [virtio_net] ? __netif_receive_skb_one_core+0x97/0x1d0 __netif_receive_skb_one_core+0x97/0x1d0 ? __netif_receive_skb_core+0x2d70/0x2d70 ? _raw_write_trylock+0x100/0x100 ? __queue_work+0x41e/0xbe0 process_backlog+0x19c/0x650 ? _raw_read_lock_irq+0x40/0x40 net_rx_action+0x71e/0xbc0 ? __switch_to_asm+0x40/0x70 ? napi_complete_done+0x360/0x360 ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70 ? __schedule+0x85e/0x14d0 __do_softirq+0x1db/0x5f9 ? takeover_tasklets+0x5f0/0x5f0 run_ksoftirqd+0x26/0x40 smpboot_thread_fn+0x443/0x680 ? sort_range+0x20/0x20 ? schedule+0x94/0x210 ? __kthread_parkme+0x78/0xf0 ? sort_range+0x20/0x20 kthread+0x2ae/0x3a0 ? kthread_create_worker_on_cpu+0xc0/0xc0 ret_from_fork+0x35/0x40 The buggy address belongs to the page: page:ffffea0001084c00 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 flags: 0xffffc000000000() raw: 00ffffc000000000 ffffea0000cfca08 ffffea0001098608 0000000000000000 raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888042130180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888042130200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ffff888042130280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888042130300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888042130380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taint Fixes: bc8c20acaea1 ("bridge: multicast: treat igmpv3 report with INCLUDE and no sources as a leave") Reported-by: Martin Weinelt Signed-off-by: Nikolay Aleksandrov Tested-by: Martin Weinelt --- net/bridge/br_multicast.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index de22c8fbbb15..f37897e7b97b 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -911,6 +911,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, int type; int err = 0; __be32 group; + u16 nsrcs; ih = igmpv3_report_hdr(skb); num = ntohs(ih->ngrec); @@ -924,8 +925,9 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, grec = (void *)(skb->data + len - sizeof(*grec)); group = grec->grec_mca; type = grec->grec_type; + nsrcs = ntohs(grec->grec_nsrcs); - len += ntohs(grec->grec_nsrcs) * 4; + len += nsrcs * 4; if (!ip_mc_may_pull(skb, len)) return -EINVAL; @@ -946,7 +948,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, src = eth_hdr(skb)->h_source; if ((type == IGMPV3_CHANGE_TO_INCLUDE || type == IGMPV3_MODE_IS_INCLUDE) && - ntohs(grec->grec_nsrcs) == 0) { + nsrcs == 0) { br_ip4_multicast_leave_group(br, port, group, vid, src); } else { err = br_ip4_multicast_add_group(br, port, group, vid, @@ -983,7 +985,8 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, len = skb_transport_offset(skb) + sizeof(*icmp6h); for (i = 0; i < num; i++) { - __be16 *nsrcs, _nsrcs; + __be16 *_nsrcs, __nsrcs; + u16 nsrcs; nsrcs_offset = len + offsetof(struct mld2_grec, grec_nsrcs); @@ -991,12 +994,13 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, nsrcs_offset + sizeof(_nsrcs)) return -EINVAL; - nsrcs = skb_header_pointer(skb, nsrcs_offset, - sizeof(_nsrcs), &_nsrcs); - if (!nsrcs) + _nsrcs = skb_header_pointer(skb, nsrcs_offset, + sizeof(__nsrcs), &__nsrcs); + if (!_nsrcs) return -EINVAL; - grec_len = struct_size(grec, grec_src, ntohs(*nsrcs)); + nsrcs = ntohs(*_nsrcs); + grec_len = struct_size(grec, grec_src, nsrcs); if (!ipv6_mc_may_pull(skb, len + grec_len)) return -EINVAL; @@ -1021,7 +1025,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, src = eth_hdr(skb)->h_source; if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE || grec->grec_type == MLD2_MODE_IS_INCLUDE) && - ntohs(*nsrcs) == 0) { + nsrcs == 0) { br_ip6_multicast_leave_group(br, port, &grec->grec_mca, vid, src); } else { From patchwork Tue Jul 2 12:00:19 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 1126225 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=cumulusnetworks.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="VfM/JxZt"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45dNGX3gV8z9sNC for ; Tue, 2 Jul 2019 22:05:08 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726917AbfGBMFH (ORCPT ); Tue, 2 Jul 2019 08:05:07 -0400 Received: from mail-wm1-f65.google.com ([209.85.128.65]:34996 "EHLO mail-wm1-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726252AbfGBMFG (ORCPT ); Tue, 2 Jul 2019 08:05:06 -0400 Received: by mail-wm1-f65.google.com with SMTP id c6so737541wml.0 for ; Tue, 02 Jul 2019 05:05:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=jZeZkNBqQvCAlH/hG07VtX1l/wTFKdXlR218Y21cdaA=; b=VfM/JxZtMLXdHJ304kMnAg+hNAShLmLB+f4aXwzJ40luxY0rk5+bKx12dupRbLqRIC TwCGJTdwyrt1kqFtmp/6+lGZmtXRf//2toowM4iGF9qtZ4XL8nzCGwKj5Xwb0gF7Rdf7 ZDakyGjX7DTyaxGt/YkAd5+o1aNYkoZICShuk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=jZeZkNBqQvCAlH/hG07VtX1l/wTFKdXlR218Y21cdaA=; b=s/JX5rL6gfKJG1yHeVTQmYQ+2fFyPH8YIyLe9LVxcQF5mMtjgiOTE3XO1NU1zT/jc1 JyJ3OWYpMGRoVtZTyxulvGP13C+AL2nN9+96TFQi8asXprSubzr/H7zOl4/jO2IMq0OY +yLtBfIYpsXrkXkxKakg4X06oTb7MqUh1VsfcnmIBEx4nu/ovEEYSP01jIk0jq9hif8V 4rI8PHUlsm7o+Fxq9m8FVJQtkPn8qs3qAaEbwOgv+B5Ths6+Wdfl95rjUH+RpiYtwRHb VV9bE3nAfutBPumEG0eoNaB61Xj2Y0fMmoV6uhA4JpAhBQvPEbKMS59L90g/O5xKYg6d 5B7g== X-Gm-Message-State: APjAAAUx1M7Op4jjLN1WnslgybOIHdEhuOS1hiUdc/YHqa834T78xV5I 3VkLNmh0/wreo95vg4tQuqUFTGTtiv0= X-Google-Smtp-Source: APXvYqytdprwFvV9n4ofcfgurfK6tThS7bCfZ36HkC9giWMgFD/S8bTrG5sypK+LW+CqDK0VEgs2qg== X-Received: by 2002:a1c:968c:: with SMTP id y134mr3083565wmd.122.1562069104211; Tue, 02 Jul 2019 05:05:04 -0700 (PDT) Received: from localhost.localdomain (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id x5sm2542655wmf.33.2019.07.02.05.05.03 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Tue, 02 Jul 2019 05:05:03 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: roopa@cumulusnetworks.com, davem@davemloft.net, martin@linuxlounge.net, bridge@lists.linux-foundation.org, yoshfuji@linux-ipv6.org, Nikolay Aleksandrov Subject: [PATCH net 2/4] net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query Date: Tue, 2 Jul 2019 15:00:19 +0300 Message-Id: <20190702120021.13096-3-nikolay@cumulusnetworks.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190702120021.13096-1-nikolay@cumulusnetworks.com> References: <20190702120021.13096-1-nikolay@cumulusnetworks.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org We get a pointer to the ipv6 hdr in br_ip6_multicast_query but we may call pskb_may_pull afterwards and end up using a stale pointer. So use the header directly, it's just 1 place where it's needed. Fixes: 08b202b67264 ("bridge br_multicast: IPv6 MLD support.") Signed-off-by: Nikolay Aleksandrov Tested-by: Martin Weinelt --- net/bridge/br_multicast.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index f37897e7b97b..3d8deac2353d 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1279,7 +1279,6 @@ static int br_ip6_multicast_query(struct net_bridge *br, u16 vid) { unsigned int transport_len = ipv6_transport_len(skb); - const struct ipv6hdr *ip6h = ipv6_hdr(skb); struct mld_msg *mld; struct net_bridge_mdb_entry *mp; struct mld2_query *mld2q; @@ -1323,7 +1322,7 @@ static int br_ip6_multicast_query(struct net_bridge *br, if (is_general_query) { saddr.proto = htons(ETH_P_IPV6); - saddr.u.ip6 = ip6h->saddr; + saddr.u.ip6 = ipv6_hdr(skb)->saddr; br_multicast_query_received(br, port, &br->ip6_other_query, &saddr, max_delay); From patchwork Tue Jul 2 12:00:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 1126227 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=cumulusnetworks.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="c07Tl1f1"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45dNGZ0fDwz9sLt for ; Tue, 2 Jul 2019 22:05:10 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726967AbfGBMFJ (ORCPT ); Tue, 2 Jul 2019 08:05:09 -0400 Received: from mail-wr1-f65.google.com ([209.85.221.65]:46161 "EHLO mail-wr1-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726455AbfGBMFH (ORCPT ); Tue, 2 Jul 2019 08:05:07 -0400 Received: by mail-wr1-f65.google.com with SMTP id n4so17472486wrw.13 for ; Tue, 02 Jul 2019 05:05:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=GSx4QIELcR9xkyWBBehy9lJ5hvGJj8dGQFampul0IVo=; b=c07Tl1f1180GeriB7zwf34KMNMsCmC/35YWN2Xf7IiGiK2diGwyj2aLaRuQ5b1sDmD g/fu1pIACSjwIQd/ayCbGYfovi7AWeJm+ZOPyfiW1/RtwRVvY2pXOW0i+tY3uzayykT2 EH6Tnx3B37L0IDhBlr2e1XLQgEH67keGETSCA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=GSx4QIELcR9xkyWBBehy9lJ5hvGJj8dGQFampul0IVo=; b=SKK4CLbkGXRhtx/iaRiy7IxOorPWc7/6fPqwFt5BZDsxmuqf2cgSOBFvh5oYeb+zSV LEF+Dn0CjN93nITE9KdctlAkaGg5JFTcLbZIDuGtpiJZahzM1lZtroWeiSjUplnzp044 odB9rtLz5QpZC/cOslNqx9pKMrG2JR88NdCc28PBn+Y8ClpaAOdiPy/rsv9W378vZkVY PCgLnpdJsIcUrlryXQgMQFCTpu9gDrNKl1hvbeynXPGjHiSecdKCZvmRn+DVyuOI2/rt +WIXr2ofDMeEGSbgEqbAGYgCnKqzUw4qA5HBb/P7F5NMyTM4J8jC4thu9ZLiGt1Iibuu bpjA== X-Gm-Message-State: APjAAAUc08rOkTWuygsJB9zQ635AFrZtH6NS2rIhFhhAvlU8gM8nTO1r 04t3D4I2qvGMxKPISrimAI4oIbjpsO4= X-Google-Smtp-Source: APXvYqzxxVjoGTiFJtaahtI1xEpd1fIsUsn8/FDyH+w3WSKMF+W5Sor6PwOTl0I1q/PCDNIvh61wcw== X-Received: by 2002:adf:b69a:: with SMTP id j26mr15838677wre.93.1562069105328; Tue, 02 Jul 2019 05:05:05 -0700 (PDT) Received: from localhost.localdomain (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id x5sm2542655wmf.33.2019.07.02.05.05.04 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Tue, 02 Jul 2019 05:05:04 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: roopa@cumulusnetworks.com, davem@davemloft.net, martin@linuxlounge.net, bridge@lists.linux-foundation.org, yoshfuji@linux-ipv6.org, Nikolay Aleksandrov Subject: [PATCH net 3/4] net: bridge: don't cache ether dest pointer on input Date: Tue, 2 Jul 2019 15:00:20 +0300 Message-Id: <20190702120021.13096-4-nikolay@cumulusnetworks.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190702120021.13096-1-nikolay@cumulusnetworks.com> References: <20190702120021.13096-1-nikolay@cumulusnetworks.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org We would cache ether dst pointer on input in br_handle_frame_finish but after the neigh suppress code that could lead to a stale pointer since both ipv4 and ipv6 suppress code do pskb_may_pull. This means we have to always reload it after the suppress code so there's no point in having it cached just retrieve it directly. Fixes: 057658cb33fbf ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports") Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Signed-off-by: Nikolay Aleksandrov --- net/bridge/br_input.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c index 21b74e7a7b2f..52c712984cc7 100644 --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c @@ -74,7 +74,6 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb struct net_bridge_fdb_entry *dst = NULL; struct net_bridge_mdb_entry *mdst; bool local_rcv, mcast_hit = false; - const unsigned char *dest; struct net_bridge *br; u16 vid = 0; @@ -92,10 +91,9 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false); local_rcv = !!(br->dev->flags & IFF_PROMISC); - dest = eth_hdr(skb)->h_dest; - if (is_multicast_ether_addr(dest)) { + if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) { /* by definition the broadcast is also a multicast address */ - if (is_broadcast_ether_addr(dest)) { + if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) { pkt_type = BR_PKT_BROADCAST; local_rcv = true; } else { @@ -145,7 +143,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb } break; case BR_PKT_UNICAST: - dst = br_fdb_find_rcu(br, dest, vid); + dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid); default: break; } From patchwork Tue Jul 2 12:00:21 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 1126226 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=cumulusnetworks.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="Jcf5gvAu"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45dNGY04Wbz9sLt for ; Tue, 2 Jul 2019 22:05:09 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726962AbfGBMFI (ORCPT ); Tue, 2 Jul 2019 08:05:08 -0400 Received: from mail-wr1-f68.google.com ([209.85.221.68]:34183 "EHLO mail-wr1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725767AbfGBMFH (ORCPT ); Tue, 2 Jul 2019 08:05:07 -0400 Received: by mail-wr1-f68.google.com with SMTP id u18so988962wru.1 for ; Tue, 02 Jul 2019 05:05:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=idQcbvzPIu1BSdVQIplt97QLkM9ok6uSRBt+kD2R0VY=; b=Jcf5gvAuECDHnSqlWrJl59LMVaLbAq8Zcjj51ekAPjCZnrcPLabHmGPaEC/zzSNAPh REueJzvJg/hipwla5YFSjsi+BhDtSH0TpqY2lAxiiGvHbJ+3/HB8eyarYmn5Q3PdrQTy kwUI9wi0zeGfbhZDFT/O6IAGaK/a5cYvHspWg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=idQcbvzPIu1BSdVQIplt97QLkM9ok6uSRBt+kD2R0VY=; b=tJ2I7waBFJ2KAW/nYCXEhWLExxqT2/GOBudHQcRfPwGWvxQLBakujNWvBrdXOg9RzV 8Z9zpUBZ/sQZPx/8DJzjEmVqtwRL3dux2bCMTgm0C+Ft6eRk6XW7BUUitevrVW7UtZ6k nQnfcCRwkVpJZ4mzoDyXMVcLPNPPysJ/MvnHW6ErwOpOrxT3co77tEuZmlV0wOBVDbjR z2o5pOFZEQbtfJgQzgRWyJx+XS2zfy5m+hILvCqjByQNnuqPdijT/IuaFPkIH1vdUWBZ SFcbiIOd7oWDm/4Tq1MXgH9r/M4nVwD2+gFXLPWSCoc/seJAxta+69+5V7JB/6SD8wCt HFBg== X-Gm-Message-State: APjAAAXtBrH2l5cAqsk4/5tzdQqo/NIVZdnoN7uBz0Q7kXjKWOT+f4H1 du/k9Y+0wcYp1McLp1jsSqI0nxC9eTI= X-Google-Smtp-Source: APXvYqwfE1BZM0ah4AdPm6PvSxcO/B0fXqWs+cIVyF+4T5t9StbPfChMJtqePWxmMI2XbhzR6h38bA== X-Received: by 2002:adf:ab0f:: with SMTP id q15mr7637137wrc.325.1562069106370; Tue, 02 Jul 2019 05:05:06 -0700 (PDT) Received: from localhost.localdomain (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id x5sm2542655wmf.33.2019.07.02.05.05.05 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Tue, 02 Jul 2019 05:05:05 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: roopa@cumulusnetworks.com, davem@davemloft.net, martin@linuxlounge.net, bridge@lists.linux-foundation.org, yoshfuji@linux-ipv6.org, Nikolay Aleksandrov Subject: [PATCH net 4/4] net: bridge: stp: don't cache eth dest pointer before skb pull Date: Tue, 2 Jul 2019 15:00:21 +0300 Message-Id: <20190702120021.13096-5-nikolay@cumulusnetworks.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190702120021.13096-1-nikolay@cumulusnetworks.com> References: <20190702120021.13096-1-nikolay@cumulusnetworks.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Don't cache eth dest pointer before calling pskb_may_pull. Fixes: cf0f02d04a83 ("[BRIDGE]: use llc for receiving STP packets") Signed-off-by: Nikolay Aleksandrov --- net/bridge/br_stp_bpdu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c index 68a6922b4141..7796dd9d42d7 100644 --- a/net/bridge/br_stp_bpdu.c +++ b/net/bridge/br_stp_bpdu.c @@ -143,7 +143,6 @@ void br_send_tcn_bpdu(struct net_bridge_port *p) void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, struct net_device *dev) { - const unsigned char *dest = eth_hdr(skb)->h_dest; struct net_bridge_port *p; struct net_bridge *br; const unsigned char *buf; @@ -172,7 +171,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, if (p->state == BR_STATE_DISABLED) goto out; - if (!ether_addr_equal(dest, br->group_addr)) + if (!ether_addr_equal(eth_hdr(skb)->h_dest, br->group_addr)) goto out; if (p->flags & BR_BPDU_GUARD) {