Nikolay Aleksandrov
79855be644
net: bridge: fix vlan tunnel dst refcnt when egressing
commit cfc579f9d89af4ada58c69b03bcaa4887840f3b3 upstream.
The egress tunnel code uses dst_clone() and directly sets the result
which is wrong because the entry might have 0 refcnt or be already deleted,
causing number of problems. It also triggers the WARN_ON() in dst_hold()[1]
when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and
checking if a reference was actually taken before setting the dst.
[1] dmesg WARN_ON log and following refcnt errors
WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net
CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49
RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0
RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001
R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401
FS: 0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0
Call Trace:
br_handle_vlan+0xbc/0xca [bridge]
__br_forward+0x23/0x164 [bridge]
deliver_clone+0x41/0x48 [bridge]
br_handle_frame_finish+0x36f/0x3aa [bridge]
? skb_dst+0x2e/0x38 [bridge]
? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]
? br_handle_frame_finish+0x3aa/0x3aa [bridge]
br_handle_frame+0x2c3/0x377 [bridge]
? __skb_pull+0x33/0x51
? vlan_do_receive+0x4f/0x36a
? br_handle_frame_finish+0x3aa/0x3aa [bridge]
__netif_receive_skb_core+0x539/0x7c6
? __list_del_entry_valid+0x16e/0x1c2
__netif_receive_skb_list_core+0x6d/0xd6
netif_receive_skb_list_internal+0x1d9/0x1fa
gro_normal_list+0x22/0x3e
dev_gro_receive+0x55b/0x600
? detach_buf_split+0x58/0x140
napi_gro_receive+0x94/0x12e
virtnet_poll+0x15d/0x315 [virtio_net]
__napi_poll+0x2c/0x1c9
net_rx_action+0xe6/0x1fb
__do_softirq+0x115/0x2d8
run_ksoftirqd+0x18/0x20
smpboot_thread_fn+0x183/0x19c
? smpboot_unregister_percpu_thread+0x66/0x66
kthread+0x10a/0x10f
? kthread_mod_delayed_work+0xb6/0xb6
ret_from_fork+0x22/0x30
---[ end trace 49f61b07f775fd2b ]---
dst_release: dst:00000000c02d677a refcnt:-1
dst_release underflow
Cc: stable@vger.kernel.org
Fixes: 11538d039a ("bridge: vlan dst_metadata hooks in ingress and egress paths")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2021-06-23 14:41:30 +02:00 |
| .. |
|
6lowpan
|
|
|
|
9p
|
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
|
2020-11-05 11:43:20 +01:00 |
|
802
|
|
|
|
8021q
|
net: vlan: avoid leaks on register_vlan_dev() failures
|
2021-01-17 14:05:31 +01:00 |
|
appletalk
|
appletalk: Fix skb allocation size in loopback case
|
2021-04-07 14:47:41 +02:00 |
|
atm
|
atm: fix a memory leak of vcc->user_back
|
2020-10-01 13:17:58 +02:00 |
|
ax25
|
AX.25: Prevent integer overflows in connect and sendmsg
|
2020-07-31 18:39:31 +02:00 |
|
batman-adv
|
batman-adv: Avoid WARN_ON timing related checks
|
2021-06-23 14:41:23 +02:00 |
|
bluetooth
|
Bluetooth: use correct lock to prevent UAF of hdev object
|
2021-06-10 13:37:09 +02:00 |
|
bpf
|
|
|
|
bpfilter
|
net/bpfilter: remove superfluous testing message
|
2020-04-21 09:04:53 +02:00 |
|
bridge
|
net: bridge: fix vlan tunnel dst refcnt when egressing
|
2021-06-23 14:41:30 +02:00 |
|
caif
|
net: caif: fix memory leak in cfusbl_device_notify
|
2021-06-10 13:37:10 +02:00 |
|
can
|
can: j1939: fix Use-after-Free, hold skb ref while in use
|
2021-06-23 14:41:28 +02:00 |
|
ceph
|
libceph: clear con->out_msg on Policy::stateful_server faults
|
2020-11-05 11:43:34 +01:00 |
|
core
|
net: make get_net_ns return error if NET_NS is disabled
|
2021-06-23 14:41:25 +02:00 |
|
dcb
|
net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
|
2021-01-23 15:57:59 +01:00 |
|
dccp
|
ipv6: weaken the v4mapped source check
|
2021-04-07 14:47:38 +02:00 |
|
decnet
|
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
|
2020-01-04 19:18:58 +01:00 |
|
dns_resolver
|
KEYS: Don't write out to userspace while holding key semaphore
|
2020-04-23 10:36:45 +02:00 |
|
dsa
|
net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count
|
2021-06-03 08:59:12 +02:00 |
|
ethernet
|
net: add annotations on hh->hh_len lockless accesses
|
2020-01-09 10:20:06 +01:00 |
|
hsr
|
hsr: use netdev_err() instead of WARN_ONCE()
|
2021-05-14 09:44:10 +02:00 |
|
ieee802154
|
net: ieee802154: fix null deref in parse dev addr
|
2021-06-18 09:58:57 +02:00 |
|
ife
|
|
|
|
ipv4
|
icmp: don't send out ICMP messages with a source address of 0.0.0.0
|
2021-06-23 14:41:27 +02:00 |
|
ipv6
|
udp: fix race between close() and udp_abort()
|
2021-06-23 14:41:24 +02:00 |
|
iucv
|
net/af_iucv: remove WARN_ONCE on malformed RX packets
|
2021-03-07 12:20:42 +01:00 |
|
kcm
|
|
|
|
key
|
af_key: relax availability checks for skb size calculation
|
2021-02-13 13:52:54 +01:00 |
|
l2tp
|
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
|
2020-07-22 09:32:47 +02:00 |
|
l3mdev
|
|
|
|
lapb
|
net: lapb: Copy the skb before sending a packet
|
2021-02-10 09:25:28 +01:00 |
|
llc
|
net: silence data-races on sk_backlog.tail
|
2020-10-01 13:17:15 +02:00 |
|
mac80211
|
mac80211: extend protection against mixed key and fragment cache attacks
|
2021-06-03 08:59:02 +02:00 |
|
mac802154
|
net: mac802154: Fix general protection fault
|
2021-04-14 08:24:18 +02:00 |
|
mpls
|
net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
|
2021-03-17 17:03:31 +01:00 |
|
ncsi
|
net/ncsi: Avoid channel_monitor hrtimer deadlock
|
2021-04-14 08:24:15 +02:00 |
|
netfilter
|
netfilter: synproxy: Fix out of bounds when parsing TCP options
|
2021-06-23 14:41:25 +02:00 |
|
netlabel
|
cipso,calipso: resolve a number of problems with the DOI refcounts
|
2021-03-17 17:03:35 +01:00 |
|
netlink
|
netlink: disable IRQs for netlink_lock_table()
|
2021-06-16 11:59:34 +02:00 |
|
netrom
|
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
|
2020-04-29 16:33:08 +02:00 |
|
nfc
|
net/nfc/rawsock.c: fix a permission check bug
|
2021-06-16 11:59:33 +02:00 |
|
nsh
|
|
|
|
openvswitch
|
openvswitch: meter: fix race when getting now_ms.
|
2021-06-03 08:59:13 +02:00 |
|
packet
|
net/packet: fix overflow in tpacket_rcv
|
2020-09-09 19:12:29 +02:00 |
|
phonet
|
net: use skb_queue_empty_lockless() in poll() handlers
|
2019-10-28 13:33:41 -07:00 |
|
psample
|
net: psample: fix skb_over_panic
|
2019-12-04 22:30:54 +01:00 |
|
qrtr
|
net: qrtr: fix OOB Read in qrtr_endpoint_post
|
2021-06-23 14:41:25 +02:00 |
|
rds
|
net: rds: fix memory leak in rds_recvmsg
|
2021-06-23 14:41:24 +02:00 |
|
rfkill
|
rfkill: Fix use-after-free in rfkill_resume()
|
2020-11-24 13:29:05 +01:00 |
|
rose
|
rose: Fix Null pointer dereference in rose_send_frame()
|
2020-12-08 10:40:23 +01:00 |
|
rxrpc
|
rxrpc: Fix clearance of Tx/Rx ring when releasing a call
|
2021-02-17 10:35:18 +01:00 |
|
sched
|
sch_cake: Fix out of bounds when parsing TCP options and header
|
2021-06-23 14:41:25 +02:00 |
|
sctp
|
sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
|
2021-05-19 10:08:27 +02:00 |
|
smc
|
Revert "net/smc: fix a NULL pointer dereference"
|
2021-06-03 08:59:08 +02:00 |
|
strparser
|
|
|
|
sunrpc
|
sunrpc: Fix misplaced barrier in call_decode
|
2021-05-19 10:08:27 +02:00 |
|
switchdev
|
net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP
|
2021-02-07 15:35:46 +01:00 |
|
tipc
|
tipc: fix unique bearer names sanity check
|
2021-06-10 13:37:08 +02:00 |
|
tls
|
tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT
|
2021-06-03 08:59:13 +02:00 |
|
unix
|
net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
|
2021-06-23 14:41:26 +02:00 |
|
vmw_vsock
|
vsock/vmci: log once the failed queue pair allocation
|
2021-05-14 09:44:30 +02:00 |
|
wimax
|
|
|
|
wireless
|
cfg80211: avoid double free of PMSR request
|
2021-06-23 14:41:30 +02:00 |
|
x25
|
net/x25: Return the correct errno code
|
2021-06-18 09:59:00 +02:00 |
|
xdp
|
xsk: Simplify detection of empty and full rings
|
2021-05-22 11:38:27 +02:00 |
|
xfrm
|
net: xfrm: Localize sequence counter per network namespace
|
2021-04-14 08:24:13 +02:00 |
|
compat.c
|
net: Return the correct errno code
|
2021-06-18 09:59:00 +02:00 |
|
Kconfig
|
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
|
2020-04-01 11:02:18 +02:00 |
|
Makefile
|
|
|
|
socket.c
|
net: make get_net_ns return error if NET_NS is disabled
|
2021-06-23 14:41:25 +02:00 |
|
sysctl_net.c
|
|
|