netdev - [PATCH net] bridge: fix multicast router rlist endless loop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue,  9 Jun 2015 02:32:28 -0700
From:	Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
To:	netdev@...r.kernel.org
Cc:	davem@...emloft.net, stephen@...workplumber.org,
	herbert@...dor.apana.org.au,
	Nikolay Aleksandrov <razor@...ckwall.org>
Subject: [PATCH net] bridge: fix multicast router rlist endless loop

From: Nikolay Aleksandrov <razor@...ckwall.org>

Since the addition of sysfs multicast router support if one set
multicast_router to "2" more than once, then the port would be added to the
hlist every time and could end up linking to itself and thus causing an
endless loop for rlist walkers.
So to reproduce just do:
echo 2 > multicast_router; echo 2 > multicast_router;
in a bridge port and let some igmp traffic flow, for me it hangs up
in br_multicast_flood().
Fix this by removing the "val < 2" check, and just do the hlist_del
always.
We can remove the "!hlist_unhashed" check because it's already done by
hlist_del_init_rcu(), in fact this can also be done for
br_multicast_disable_port() but that is net-next material.
The reason this didn't happen before the addition of multicast_router
sysfs entries is because there's a !hlist_unhashed check that prevents
it.

Signed-off-by: Nikolay Aleksandrov <razor@...ckwall.org>
Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries")
---
 net/bridge/br_multicast.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 22fd0419b314..ecdd13512320 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1993,8 +1993,7 @@ int br_multicast_set_port_router(struct net_bridge_port *p, unsigned long val)
 		p->multicast_router = val;
 		err = 0;

-		if (val < 2 && !hlist_unhashed(&p->rlist))
-			hlist_del_init_rcu(&p->rlist);
+		hlist_del_init_rcu(&p->rlist);

 		if (val == 1)
 			break;
-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html