Sebastian Andrzej Siewior 6dea95f640 hsr: Avoid double remove of a node. ... [ Upstream commit 0c74d9f79e ] Due to the hashed-MAC optimisation one problem become visible: hsr_handle_sup_frame() walks over the list of available nodes and merges two node entries into one if based on the information in the supervision both MAC addresses belong to one node. The list-walk happens on a RCU protected list and delete operation happens under a lock. If the supervision arrives on both slave interfaces at the same time then this delete operation can occur simultaneously on two CPUs. The result is the first-CPU deletes the from the list and the second CPUs BUGs while attempting to dereference a poisoned list-entry. This happens more likely with the optimisation because a new node for the mac_B entry is created once a packet has been received and removed (merged) once the supervision frame has been received. Avoid removing/ cleaning up a hsr_node twice by adding a `removed' field which is set to true after the removal and checked before the removal. Fixes: f266a683a4 ("net/hsr: Better frame dispatch") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-01-18 11:41:09 +01:00
..
Kconfig	…
Makefile	…
hsr_debugfs.c	…
hsr_device.c	net: hsr: Reset MAC header for Tx path	2021-04-14 08:24:12 +02:00
hsr_device.h	…
hsr_forward.c	net: hsr: Fix potential use-after-free	2022-12-08 11:23:03 +01:00
hsr_forward.h	…
hsr_framereg.c	hsr: Avoid double remove of a node.	2023-01-18 11:41:09 +01:00
hsr_framereg.h	hsr: Avoid double remove of a node.	2023-01-18 11:41:09 +01:00
hsr_main.c	…
hsr_main.h	…
hsr_netlink.c	hsr: check protocol version in hsr_newlink()	2020-04-21 09:04:44 +02:00
hsr_netlink.h	…
hsr_slave.c	hsr: fix general protection fault in hsr_addr_is_self()	2020-04-01 11:01:31 +02:00
hsr_slave.h	…