1
0
Fork 0
remarkable-linux/net/bridge
Nikolay Aleksandrov 806d70c7da net: bridge: fix old ioctl unlocked net device walk
[ Upstream commit 31ca0458a6 ]

get_bridge_ifindices() is used from the old "deviceless" bridge ioctl
calls which aren't called with rtnl held. The comment above says that it is
called with rtnl but that is not really the case.
Here's a sample output from a test ASSERT_RTNL() which I put in
get_bridge_ifindices and executed "brctl show":
[  957.422726] RTNL: assertion failed at net/bridge//br_ioctl.c (30)
[  957.422925] CPU: 0 PID: 1862 Comm: brctl Tainted: G        W  O
4.6.0-rc4+ #157
[  957.423009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.8.1-20150318_183358- 04/01/2014
[  957.423009]  0000000000000000 ffff880058adfdf0 ffffffff8138dec5
0000000000000400
[  957.423009]  ffffffff81ce8380 ffff880058adfe58 ffffffffa05ead32
0000000000000001
[  957.423009]  00007ffec1a444b0 0000000000000400 ffff880053c19130
0000000000008940
[  957.423009] Call Trace:
[  957.423009]  [<ffffffff8138dec5>] dump_stack+0x85/0xc0
[  957.423009]  [<ffffffffa05ead32>]
br_ioctl_deviceless_stub+0x212/0x2e0 [bridge]
[  957.423009]  [<ffffffff81515beb>] sock_ioctl+0x22b/0x290
[  957.423009]  [<ffffffff8126ba75>] do_vfs_ioctl+0x95/0x700
[  957.423009]  [<ffffffff8126c159>] SyS_ioctl+0x79/0x90
[  957.423009]  [<ffffffff8163a4c0>] entry_SYSCALL_64_fastpath+0x23/0xc1

Since it only reads bridge ifindices, we can use rcu to safely walk the net
device list. Also remove the wrong rtnl comment above.

Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:25 -04:00
..
netfilter Revert "netfilter: ensure number of counters is >0 in do_replace()" 2015-06-01 19:45:47 +02:00
Kconfig bridge: Add vlan filtering infrastructure 2013-02-13 19:41:46 -05:00
Makefile netfilter: bridge: build br_nf_core only if required 2014-09-30 14:07:51 -04:00
br.c switchdev: Require RTNL mutex to be held when sending FDB notifications 2016-03-04 10:25:47 -05:00
br_device.c bridge: fix lockdep addr_list_lock false positive splat 2016-01-31 11:23:37 -08:00
br_fdb.c bridge: disable softirqs around br_fdb_update to avoid lockup 2015-06-07 19:44:13 -07:00
br_forward.c bridge: fix potential crash in __netdev_pick_tx() 2015-09-29 19:26:21 +02:00
br_if.c bridge: reset bridge mtu after deleting an interface 2015-03-14 19:12:38 -04:00
br_input.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
br_ioctl.c net: bridge: fix old ioctl unlocked net device walk 2016-07-10 23:07:25 -04:00
br_mdb.c bridge: mdb: fix double add notification 2015-09-29 19:26:22 +02:00
br_multicast.c bridge: fix igmpv3 / mldv2 report parsing 2015-10-03 13:49:15 +02:00
br_netfilter.c Revert "netfilter: bridge: query conntrack about skb dnat" 2015-05-20 13:51:25 +02:00
br_netlink.c bridge: netlink: account for the IFLA_BRPORT_PROXYARP_WIFI attribute size and policy 2015-09-29 19:26:25 +02:00
br_nf_core.c net: Remove protocol from struct dst_ops 2015-03-09 16:06:10 -04:00
br_private.h bridge/nl: remove wrong use of NLM_F_MULTI 2015-04-29 14:59:16 -04:00
br_private_stp.h net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
br_stp.c bridge: call netdev_sw_port_stp_update when bridge port STP status changes 2014-12-02 20:01:22 -08:00
br_stp_bpdu.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
br_stp_if.c bridge: Only call /sbin/bridge-stp for the initial network namespace 2016-01-31 11:23:36 -08:00
br_stp_timer.c bridge: fix lockdep splat 2015-05-22 16:23:56 -04:00
br_sysfs_br.c bridge: Add a default_pvid sysfs attribute 2014-10-05 21:21:36 -04:00
br_sysfs_if.c bridge: Extend Proxy ARP design to allow optional rules for Wi-Fi 2015-03-05 14:52:23 -05:00
br_vlan.c net: rename vlan_tx_* helpers since "tx" is misleading there 2015-01-13 17:51:08 -05:00