linux-kernel - Re: [PATCH] net/bridge: Add missing in6_dev_put in br_validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1436181400.25714.10.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Mon, 06 Jul 2015 13:16:40 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Julien Grall <julien.grall@...rix.com>
Cc:	Florian Westphal <fw@...len.de>, stephen@...workplumber.org,
	davem@...emloft.net, bridge@...ts.linux-foundation.org,
	netdev@...r.kernel.org, xen-devel@...ts.xenproject.org,
	linux-kernel@...r.kernel.org,
	Bernhard Thaler <bernhard.thaler@...et.at>,
	Pablo Neira Ayuso <pablo@...filter.org>,
	ian.campbell@...rix.com, wei.liu2@...rix.com
Subject: Re: [PATCH] net/bridge: Add missing in6_dev_put in br_validate_ipv6

On Mon, 2015-07-06 at 11:35 +0100, Julien Grall wrote:

> __in6_dev_get requires to hold rcu_read_lock or RTNL. My knowledge on
> this code is very limited. Are we sure that one this lock is hold? At
> first glance, I wasn't able to find one.

You could play it safe ;)

diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
index 6d12d2675c80..90e8ccc21cc5 100644
--- a/net/bridge/br_netfilter_ipv6.c
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -104,10 +104,12 @@ int br_validate_ipv6(struct sk_buff *skb)
 {
 	const struct ipv6hdr *hdr;
 	struct net_device *dev = skb->dev;
-	struct inet6_dev *idev = in6_dev_get(skb->dev);
+	struct inet6_dev *idev;
 	u32 pkt_len;
 	u8 ip6h_len = sizeof(struct ipv6hdr);
 
+	rcu_read_lock();
+	idev = __in6_dev_get(dev);
 	if (!pskb_may_pull(skb, ip6h_len))
 		goto inhdr_error;
 
@@ -140,11 +142,13 @@ int br_validate_ipv6(struct sk_buff *skb)
 	/* No IP options in IPv6 header; however it should be
 	 * checked if some next headers need special treatment
 	 */
+	rcu_read_unlock();
 	return 0;
 
 inhdr_error:
 	IP6_INC_STATS_BH(dev_net(dev), idev, IPSTATS_MIB_INHDRERRORS);
 drop:
+	rcu_read_unlock();
 	return -1;
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/