bridge: vlan: fix possible null vlgrp deref while registering new port
While a new port is being initialized the rx_handler gets set, but the vlans get initialized later in br_add_if() and in that window if we receive a frame with a link-local address we can try to dereference p->vlgrp in: br_handle_frame() -> br_handle_local_finish() -> br_should_learn() Fix this by checking vlgrp before using it. Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
8af78b6487
commit
468e794458
|
@ -476,13 +476,15 @@ bool br_allowed_egress(struct net_bridge_vlan_group *vg,
|
||||||
/* Called under RCU */
|
/* Called under RCU */
|
||||||
bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
|
bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
|
||||||
{
|
{
|
||||||
|
struct net_bridge_vlan_group *vg;
|
||||||
struct net_bridge *br = p->br;
|
struct net_bridge *br = p->br;
|
||||||
|
|
||||||
/* If filtering was disabled at input, let it pass. */
|
/* If filtering was disabled at input, let it pass. */
|
||||||
if (!br->vlan_enabled)
|
if (!br->vlan_enabled)
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
if (!p->vlgrp->num_vlans)
|
vg = p->vlgrp;
|
||||||
|
if (!vg || !vg->num_vlans)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
if (!br_vlan_get_tag(skb, vid) && skb->vlan_proto != br->vlan_proto)
|
if (!br_vlan_get_tag(skb, vid) && skb->vlan_proto != br->vlan_proto)
|
||||||
|
|
Loading…
Reference in a new issue