mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-28 07:13:34 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/dsa
History
Vladimir Oltean eb1ab7650d net: dsa: fix db type confusion in host fdb/mdb add/del 
We have the following code paths:

Host FDB (unicast RX filtering):

dsa_port_standalone_host_fdb_add()   dsa_port_bridge_host_fdb_add()
               |                                     |
               +--------------+         +------------+
                              |         |
                              v         v
                         dsa_port_host_fdb_add()

dsa_port_standalone_host_fdb_del()   dsa_port_bridge_host_fdb_del()
               |                                     |
               +--------------+         +------------+
                              |         |
                              v         v
                         dsa_port_host_fdb_del()

Host MDB (multicast RX filtering):

dsa_port_standalone_host_mdb_add()   dsa_port_bridge_host_mdb_add()
               |                                     |
               +--------------+         +------------+
                              |         |
                              v         v
                         dsa_port_host_mdb_add()

dsa_port_standalone_host_mdb_del()   dsa_port_bridge_host_mdb_del()
               |                                     |
               +--------------+         +------------+
                              |         |
                              v         v
                         dsa_port_host_mdb_del()

The logic added by commit 5e8a1e03aa ("net: dsa: install secondary
unicast and multicast addresses as host FDB/MDB") zeroes out
db.bridge.num if the switch doesn't support ds->fdb_isolation
(the majority doesn't). This is done for a reason explained in commit
c26933639b ("net: dsa: request drivers to perform FDB isolation").

Taking a single code path as example - dsa_port_host_fdb_add() - the
others are similar - the problem is that this function handles:
- DSA_DB_PORT databases, when called from
  dsa_port_standalone_host_fdb_add()
- DSA_DB_BRIDGE databases, when called from
  dsa_port_bridge_host_fdb_add()

So, if dsa_port_host_fdb_add() were to make any change on the
"bridge.num" attribute of the database, this would only be correct for a
DSA_DB_BRIDGE, and a type confusion for a DSA_DB_PORT bridge.

However, this bug is without consequences, for 2 reasons:

- dsa_port_standalone_host_fdb_add() is only called from code which is
  (in)directly guarded by dsa_switch_supports_uc_filtering(ds), and that
  function only returns true if ds->fdb_isolation is set. So, the code
  only executed for DSA_DB_BRIDGE databases.

- Even if the code was not dead for DSA_DB_PORT, we have the following
  memory layout:

struct dsa_bridge {
	struct net_device *dev;
	unsigned int num;
	bool tx_fwd_offload;
	refcount_t refcount;
};

struct dsa_db {
	enum dsa_db_type type;

	union {
		const struct dsa_port *dp; // DSA_DB_PORT
		struct dsa_lag lag;
		struct dsa_bridge bridge; // DSA_DB_BRIDGE
	};
};

So, the zeroization of dsa_db :: bridge :: num on a dsa_db structure of
type DSA_DB_PORT would access memory which is unused, because we only
use dsa_db :: dp for DSA_DB_PORT, and this is mapped at the same address
with dsa_db :: dev for DSA_DB_BRIDGE, thanks to the union definition.

It is correct to fix up dsa_db :: bridge :: num only from code paths
that come from the bridge / switchdev, so move these there.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20230329133819.697642-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-03-30 23:19:55 -07:00
..
devlink.c net: dsa: move rest of devlink setup/teardown to devlink.c 2022-11-22 20:41:47 -08:00
devlink.h net: dsa: move rest of devlink setup/teardown to devlink.c 2022-11-22 20:41:47 -08:00
dsa.c net: dsa: kill off dsa_priv.h 2022-11-22 20:41:54 -08:00
dsa.h net: dsa: rename dsa2.c back into dsa.c and create its header 2022-11-22 20:41:53 -08:00
Kconfig net: dsa: modularize DSA_TAG_PROTO_NONE 2022-11-22 20:41:45 -08:00
Makefile net: dsa: rename dsa2.c back into dsa.c and create its header 2022-11-22 20:41:53 -08:00
master.c net: dsa: Use sysfs_emit() to instead of sprintf() 2023-02-02 15:28:59 +01:00
master.h net: dsa: move headers exported by master.c to master.h 2022-11-22 20:41:49 -08:00
netlink.c net: dsa: kill off dsa_priv.h 2022-11-22 20:41:54 -08:00
netlink.h net: dsa: kill off dsa_priv.h 2022-11-22 20:41:54 -08:00
port.c net: dsa: fix db type confusion in host fdb/mdb add/del 2023-03-30 23:19:55 -07:00
port.h net: dsa: move headers exported by port.c to port.h 2022-11-22 20:41:48 -08:00
slave.c net: dsa: sync unicast and multicast addresses for VLAN filters too 2023-03-30 11:32:46 -07:00
slave.h net: dsa: move headers exported by slave.c to slave.h 2022-11-22 20:41:49 -08:00
switch.c net: dsa: kill off dsa_priv.h 2022-11-22 20:41:54 -08:00
switch.h net: dsa: move notifier definitions to switch.h 2022-11-22 20:41:52 -08:00
tag.c net: dsa: report rx_bytes unadjusted for ETH_HLEN 2023-03-20 09:09:53 +00:00
tag.h net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_8021q.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-12-13 09:49:29 +01:00
tag_8021q.h net: dsa: move tag_8021q headers to their proper place 2022-11-22 20:41:53 -08:00
tag_ar9331.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_brcm.c net: dsa: tag_brcm: legacy: fix daisy-chained switches 2023-03-21 17:29:13 -07:00
tag_dsa.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_gswip.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_hellcreek.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-12-08 18:19:59 -08:00
tag_ksz.c net: dsa: microchip: enable port queues for tc mqprio 2023-01-23 22:12:35 -08:00
tag_lan9303.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_mtk.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_none.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_ocelot.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_ocelot_8021q.c net: dsa: move tag_8021q headers to their proper place 2022-11-22 20:41:53 -08:00
tag_qca.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_rtl4_a.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_rtl8_4.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_rzn1_a5psw.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_sja1105.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-12-08 18:19:59 -08:00
tag_trailer.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00
tag_xrs700x.c net: dsa: move tagging protocol code to tag.{c,h} 2022-11-22 20:41:50 -08:00