mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net/bridge
History
Nikolay Aleksandrov a2b01e65d9 net: bridge: mst: fix vlan use-after-free 
[ Upstream commit 3a7c1661ae ]

syzbot reported a suspicious rcu usage[1] in bridge's mst code. While
fixing it I noticed that nothing prevents a vlan to be freed while
walking the list from the same path (br forward delay timer). Fix the rcu
usage and also make sure we are not accessing freed memory by making
br_mst_vlan_set_state use rcu read lock.

[1]
 WARNING: suspicious RCU usage
 6.9.0-rc6-syzkaller #0 Not tainted
 -----------------------------
 net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!
 ...
 stack backtrace:
 CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0
 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
 Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
  nbp_vlan_group net/bridge/br_private.h:1599 [inline]
  br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105
  br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
  br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88
  call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793
  expire_timers kernel/time/timer.c:1844 [inline]
  __run_timers kernel/time/timer.c:2418 [inline]
  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429
  run_timer_base kernel/time/timer.c:2438 [inline]
  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448
  __do_softirq+0x2c6/0x980 kernel/softirq.c:554
  invoke_softirq kernel/softirq.c:428 [inline]
  __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
  irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
  </IRQ>
  <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758
 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
 RSP: 0018:ffffc90013657100 EFLAGS: 00000206
 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001
 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60
 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0
 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28
 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246

Fixes: ec7328b591 ("net: bridge: mst: Multiple Spanning Tree (MST) mode")
Reported-by: syzbot+fa04eb8a56fd923fc5d8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fa04eb8a56fd923fc5d8
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2024-05-30 09:49:50 +02:00
..
netfilter netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:12:49 +02:00
Kconfig
…
Makefile
…
br.c net: bridge: fill in MODULE_DESCRIPTION() 2023-10-27 11:16:44 +01:00
br_arp_nd_proxy.c bridge: Add per-{Port, VLAN} neighbor suppression data path support 2023-04-21 08:25:50 +01:00
br_cfm.c
…
br_cfm_netlink.c bridge: cfm: fix enum typo in br_cc_ccm_tx_parse 2023-12-26 22:38:13 +00:00
br_device.c net: bridge: xmit: make sure we have at least eth header len bytes 2024-05-30 09:49:50 +02:00
br_fdb.c net: bridge: Track and limit dynamically learned FDB entries 2023-10-17 17:39:01 -07:00
br_forward.c net: bridge: fix corrupted ethernet header on multicast-to-unicast 2024-05-17 12:14:53 +02:00
br_if.c net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode 2023-07-03 09:11:34 +01:00
br_input.c netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:12:49 +02:00
br_ioctl.c
…
br_mdb.c bridge: mdb: Add MDB bulk deletion support 2023-12-20 11:27:20 +00:00
br_mrp.c
…
br_mrp_netlink.c
…
br_mrp_switchdev.c
…
br_mst.c net: bridge: mst: fix vlan use-after-free 2024-05-30 09:49:50 +02:00
br_multicast.c bridge: mcast: fix disabled snooping after long uptime 2024-01-30 18:06:56 -08:00
br_multicast_eht.c
…
br_netfilter_hooks.c netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:12:49 +02:00
br_netfilter_ipv6.c netfilter: bridge: replace physindev with physinif in nf_bridge_info 2024-01-17 12:02:49 +01:00
br_netlink.c net-sysfs: convert dev->operstate reads to lockless ones 2024-05-17 12:14:54 +02:00
br_netlink_tunnel.c net: bridge: Set strict_start_type at two policies 2023-02-06 08:48:25 +00:00
br_nf_core.c net: dst: Switch to rcuref_t reference counting 2023-03-28 18:52:28 -07:00
br_private.h netfilter: br_netfilter: skip conntrack input hook for promisc packets 2024-04-27 17:12:49 +02:00
br_private_cfm.h
…
br_private_mcast_eht.h
…
br_private_mrp.h
…
br_private_stp.h
…
br_private_tunnel.h bridge: always declare tunnel functions 2023-05-17 21:28:58 -07:00
br_stp.c
…
br_stp_bpdu.c
…
br_stp_if.c
…
br_stp_timer.c
…
br_switchdev.c net: bridge: switchdev: Ensure deferred event delivery on unoffload 2024-02-16 09:36:37 +00:00
br_sysfs_br.c
…
br_sysfs_if.c
…
br_vlan.c bridge: vlan: Allow setting VLAN neighbor suppression state 2023-04-21 08:25:50 +01:00
br_vlan_options.c bridge: vlan: Allow setting VLAN neighbor suppression state 2023-04-21 08:25:50 +01:00
br_vlan_tunnel.c bridge: Add backup nexthop ID support 2023-07-19 10:53:49 +01:00