https://github.com/torvalds/linux
Revision 9d332e69c1dc74dcd748de7cbd2dac5c61bda265 authored by Nikolay Aleksandrov on 16 November 2018, 16:50:01 UTC, committed by David S. Miller on 18 November 2018, 05:38:44 UTC
Syzbot reported a use-after-free of the global vlan context on port vlan
destruction. When I added per-port vlan stats I missed the fact that the
global vlan context can be freed before the per-port vlan rcu callback.
There're a few different ways to deal with this, I've chosen to add a
new private flag that is set only when per-port stats are allocated so
we can directly check it on destruction without dereferencing the global
context at all. The new field in net_bridge_vlan uses a hole.
v2: cosmetic change, move the check to br_process_vlan_info where the
other checks are done
v3: add change log in the patch, add private (in-kernel only) flags in a
hole in net_bridge_vlan struct and use that instead of mixing
user-space flags with private flags
Fixes: 9163a0fc1f0c ("net: bridge: add support for per-port vlan stats")
Reported-by: syzbot+04681da557a0e49a52e5@syzkaller.appspotmail.com
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 9550658
Tip revision: 9d332e69c1dc74dcd748de7cbd2dac5c61bda265 authored by Nikolay Aleksandrov on 16 November 2018, 16:50:01 UTC
net: bridge: fix vlan stats use-after-free on destruction
net: bridge: fix vlan stats use-after-free on destruction
Tip revision: 9d332e6
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| LICENSES | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | -rw-r--r-- | 12.7 KB |
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 31 bytes |
| .gitattributes | -rw-r--r-- | 30 bytes |
| .gitignore | -rw-r--r-- | 1.5 KB |
| .mailmap | -rw-r--r-- | 10.5 KB |
| COPYING | -rw-r--r-- | 423 bytes |
| CREDITS | -rw-r--r-- | 96.4 KB |
| Kbuild | -rw-r--r-- | 2.2 KB |
| Kconfig | -rw-r--r-- | 563 bytes |
| MAINTAINERS | -rw-r--r-- | 470.7 KB |
| Makefile | -rw-r--r-- | 59.7 KB |
| README | -rw-r--r-- | 727 bytes |
Computing file changes ...
