mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
13f6937f53
[ Upstream commit0c74d9f79e] Due to the hashed-MAC optimisation one problem become visible: hsr_handle_sup_frame() walks over the list of available nodes and merges two node entries into one if based on the information in the supervision both MAC addresses belong to one node. The list-walk happens on a RCU protected list and delete operation happens under a lock. If the supervision arrives on both slave interfaces at the same time then this delete operation can occur simultaneously on two CPUs. The result is the first-CPU deletes the from the list and the second CPUs BUGs while attempting to dereference a poisoned list-entry. This happens more likely with the optimisation because a new node for the mac_B entry is created once a packet has been received and removed (merged) once the supervision frame has been received. Avoid removing/ cleaning up a hsr_node twice by adding a `removed' field which is set to true after the removal and checked before the removal. Fixes:f266a683a4("net/hsr: Better frame dispatch") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
89 lines
2.5 KiB
C
89 lines
2.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/* Copyright 2011-2014 Autronica Fire and Security AS
|
|
*
|
|
* Author(s):
|
|
* 2011-2014 Arvid Brodin, arvid.brodin@alten.se
|
|
*
|
|
* include file for HSR and PRP.
|
|
*/
|
|
|
|
#ifndef __HSR_FRAMEREG_H
|
|
#define __HSR_FRAMEREG_H
|
|
|
|
#include "hsr_main.h"
|
|
|
|
struct hsr_node;
|
|
|
|
struct hsr_frame_info {
|
|
struct sk_buff *skb_std;
|
|
struct sk_buff *skb_hsr;
|
|
struct sk_buff *skb_prp;
|
|
struct hsr_port *port_rcv;
|
|
struct hsr_node *node_src;
|
|
u16 sequence_nr;
|
|
bool is_supervision;
|
|
bool is_vlan;
|
|
bool is_local_dest;
|
|
bool is_local_exclusive;
|
|
bool is_from_san;
|
|
};
|
|
|
|
void hsr_del_self_node(struct hsr_priv *hsr);
|
|
void hsr_del_nodes(struct list_head *node_db);
|
|
struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db,
|
|
struct sk_buff *skb, bool is_sup,
|
|
enum hsr_port_type rx_port);
|
|
void hsr_handle_sup_frame(struct hsr_frame_info *frame);
|
|
bool hsr_addr_is_self(struct hsr_priv *hsr, unsigned char *addr);
|
|
|
|
void hsr_addr_subst_source(struct hsr_node *node, struct sk_buff *skb);
|
|
void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb,
|
|
struct hsr_port *port);
|
|
|
|
void hsr_register_frame_in(struct hsr_node *node, struct hsr_port *port,
|
|
u16 sequence_nr);
|
|
int hsr_register_frame_out(struct hsr_port *port, struct hsr_node *node,
|
|
u16 sequence_nr);
|
|
|
|
void hsr_prune_nodes(struct timer_list *t);
|
|
|
|
int hsr_create_self_node(struct hsr_priv *hsr,
|
|
unsigned char addr_a[ETH_ALEN],
|
|
unsigned char addr_b[ETH_ALEN]);
|
|
|
|
void *hsr_get_next_node(struct hsr_priv *hsr, void *_pos,
|
|
unsigned char addr[ETH_ALEN]);
|
|
|
|
int hsr_get_node_data(struct hsr_priv *hsr,
|
|
const unsigned char *addr,
|
|
unsigned char addr_b[ETH_ALEN],
|
|
unsigned int *addr_b_ifindex,
|
|
int *if1_age,
|
|
u16 *if1_seq,
|
|
int *if2_age,
|
|
u16 *if2_seq);
|
|
|
|
void prp_handle_san_frame(bool san, enum hsr_port_type port,
|
|
struct hsr_node *node);
|
|
void prp_update_san_info(struct hsr_node *node, bool is_sup);
|
|
|
|
struct hsr_node {
|
|
struct list_head mac_list;
|
|
/* Protect R/W access to seq_out */
|
|
spinlock_t seq_out_lock;
|
|
unsigned char macaddress_A[ETH_ALEN];
|
|
unsigned char macaddress_B[ETH_ALEN];
|
|
/* Local slave through which AddrB frames are received from this node */
|
|
enum hsr_port_type addr_B_port;
|
|
unsigned long time_in[HSR_PT_PORTS];
|
|
bool time_in_stale[HSR_PT_PORTS];
|
|
unsigned long time_out[HSR_PT_PORTS];
|
|
/* if the node is a SAN */
|
|
bool san_a;
|
|
bool san_b;
|
|
u16 seq_out[HSR_PT_PORTS];
|
|
bool removed;
|
|
struct rcu_head rcu_head;
|
|
};
|
|
|
|
#endif /* __HSR_FRAMEREG_H */
|