| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20210809131152.509092-1-vladimir.oltean@nxp.com>
Date: Mon, 9 Aug 2021 16:11:52 +0300
From: Vladimir Oltean <vladimir.oltean@....com>
To: netdev@...r.kernel.org, Jakub Kicinski <kuba@...nel.org>,
"David S. Miller" <davem@...emloft.net>
Cc: Andrew Lunn <andrew@...n.ch>,
Florian Fainelli <f.fainelli@...il.com>,
Vivien Didelot <vivien.didelot@...il.com>,
Vladimir Oltean <olteanv@...il.com>,
Vadym Kochan <vkochan@...vell.com>,
Taras Chornyi <tchornyi@...vell.com>,
Saeed Mahameed <saeedm@...dia.com>,
Leon Romanovsky <leon@...nel.org>,
Jiri Pirko <jiri@...dia.com>, Ido Schimmel <idosch@...dia.com>,
Lars Povlsen <lars.povlsen@...rochip.com>,
Steen Hegelund <Steen.Hegelund@...rochip.com>,
UNGLinuxDriver@...rochip.com,
Grygorii Strashko <grygorii.strashko@...com>,
Julian Wiedmann <jwi@...ux.ibm.com>,
Karsten Graul <kgraul@...ux.ibm.com>,
Heiko Carstens <hca@...ux.ibm.com>,
Vasily Gorbik <gor@...ux.ibm.com>,
Christian Borntraeger <borntraeger@...ibm.com>,
Jianbo Liu <jianbol@...dia.com>,
Vlad Buslov <vladbu@...dia.com>,
Bjarni Jonasson <bjarni.jonasson@...rochip.com>,
Vignesh Raghavendra <vigneshr@...com>,
Tobias Waldekranz <tobias@...dekranz.com>,
linux-kernel@...r.kernel.org, linux-rdma@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, linux-omap@...r.kernel.org,
linux-s390@...r.kernel.org, Ido Schimmel <idosch@...sch.org>
Subject: [PATCH net] net: switchdev: zero-initialize struct switchdev_notifier_fdb_info emitted by drivers towards the bridge
The blamed commit a new field to struct switchdev_notifier_fdb_info, but
did not make sure that all call paths set it to something valid. For
example, a switchdev driver may emit a SWITCHDEV_FDB_ADD_TO_BRIDGE
notifier, and since the 'is_local' flag is not set, it contains junk
from the stack, so the bridge might interpret those notifications as
being for local FDB entries when that was not intended.
To avoid that now and in the future, zero-initialize all
switchdev_notifier_fdb_info structures created by drivers such that all
newly added fields to not need to touch drivers again.
Fixes: 2c4eca3ef716 ("net: bridge: switchdev: include local flag in FDB notifications")
Reported-by: Ido Schimmel <idosch@...sch.org>
Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>
---
drivers/net/ethernet/marvell/prestera/prestera_switchdev.c | 2 ++
drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 1 +
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 ++
drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 1 +
drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c | 1 +
drivers/net/ethernet/rocker/rocker_main.c | 1 +
drivers/net/ethernet/rocker/rocker_ofdpa.c | 1 +
drivers/net/ethernet/ti/am65-cpsw-switchdev.c | 1 +
drivers/net/ethernet/ti/cpsw_switchdev.c | 1 +
drivers/s390/net/qeth_l2_main.c | 2 ++
net/dsa/slave.c | 1 +
11 files changed, 14 insertions(+)
diff --git a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
index 0b3e8f2db294..cf60e80dd3ba 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
@@ -750,6 +750,7 @@ prestera_fdb_offload_notify(struct prestera_port *port,
{
struct switchdev_notifier_fdb_info send_info;
+ memset(&send_info, 0, sizeof(send_info));
send_info.addr = info->addr;
send_info.vid = info->vid;
send_info.offloaded = true;
@@ -1146,6 +1147,7 @@ static void prestera_fdb_event(struct prestera_switch *sw,
if (!dev)
return;
+ memset(&info, 0, sizeof(info));
info.addr = evt->fdb_evt.data.mac;
info.vid = evt->fdb_evt.vid;
info.offloaded = true;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
index a6e1d4f78268..77e09397a062 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
@@ -71,6 +71,7 @@ mlx5_esw_bridge_fdb_offload_notify(struct net_device *dev, const unsigned char *
{
struct switchdev_notifier_fdb_info send_info;
+ memset(&send_info, 0, sizeof(send_info));
send_info.addr = addr;
send_info.vid = vid;
send_info.offloaded = true;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 7e221ef01437..8a7660f2d048 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -9086,6 +9086,7 @@ static void mlxsw_sp_rif_fid_fdb_del(struct mlxsw_sp_rif *rif, const char *mac)
if (!dev)
return;
+ memset(&info, 0, sizeof(info));
info.addr = mac;
info.vid = 0;
call_switchdev_notifiers(SWITCHDEV_FDB_DEL_TO_BRIDGE, dev, &info.info,
@@ -9137,6 +9138,7 @@ static void mlxsw_sp_rif_vlan_fdb_del(struct mlxsw_sp_rif *rif, const char *mac)
if (!dev)
return;
+ memset(&info, 0, sizeof(info));
info.addr = mac;
info.vid = vid;
call_switchdev_notifiers(SWITCHDEV_FDB_DEL_TO_BRIDGE, dev, &info.info,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index c5ef9aa64efe..f016d909bead 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -2510,6 +2510,7 @@ mlxsw_sp_fdb_call_notifiers(enum switchdev_notifier_type type,
{
struct switchdev_notifier_fdb_info info;
+ memset(&info, 0, sizeof(info));
info.addr = mac;
info.vid = vid;
info.offloaded = offloaded;
diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c
index 0443f66b5550..fbc3f5e65882 100644
--- a/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c
+++ b/drivers/net/ethernet/microchip/sparx5/sparx5_mactable.c
@@ -279,6 +279,7 @@ static void sparx5_fdb_call_notifiers(enum switchdev_notifier_type type,
{
struct switchdev_notifier_fdb_info info;
+ memset(&info, 0, sizeof(info));
info.addr = mac;
info.vid = vid;
info.offloaded = offloaded;
diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
index a46633606cae..49d548be9fe4 100644
--- a/drivers/net/ethernet/rocker/rocker_main.c
+++ b/drivers/net/ethernet/rocker/rocker_main.c
@@ -2717,6 +2717,7 @@ rocker_fdb_offload_notify(struct rocker_port *rocker_port,
{
struct switchdev_notifier_fdb_info info;
+ memset(&info, 0, sizeof(info));
info.addr = recv_info->addr;
info.vid = recv_info->vid;
info.offloaded = true;
diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
index 967a634ee9ac..7d954fd24134 100644
--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
@@ -1824,6 +1824,7 @@ static void ofdpa_port_fdb_learn_work(struct work_struct *work)
bool learned = (lw->flags & OFDPA_OP_FLAG_LEARNED);
struct switchdev_notifier_fdb_info info;
+ memset(&info, 0, sizeof(info));
info.addr = lw->addr;
info.vid = lw->vid;
diff --git a/drivers/net/ethernet/ti/am65-cpsw-switchdev.c b/drivers/net/ethernet/ti/am65-cpsw-switchdev.c
index 9c29b363e9ae..81d2b1765a66 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-switchdev.c
+++ b/drivers/net/ethernet/ti/am65-cpsw-switchdev.c
@@ -360,6 +360,7 @@ static void am65_cpsw_fdb_offload_notify(struct net_device *ndev,
{
struct switchdev_notifier_fdb_info info;
+ memset(&info, 0, sizeof(info));
info.addr = rcv->addr;
info.vid = rcv->vid;
info.offloaded = true;
diff --git a/drivers/net/ethernet/ti/cpsw_switchdev.c b/drivers/net/ethernet/ti/cpsw_switchdev.c
index f7fb6e17dadd..446bdab06bdd 100644
--- a/drivers/net/ethernet/ti/cpsw_switchdev.c
+++ b/drivers/net/ethernet/ti/cpsw_switchdev.c
@@ -370,6 +370,7 @@ static void cpsw_fdb_offload_notify(struct net_device *ndev,
{
struct switchdev_notifier_fdb_info info;
+ memset(&info, 0, sizeof(info));
info.addr = rcv->addr;
info.vid = rcv->vid;
info.offloaded = true;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 2abf86c104d5..843dd4f4d8d7 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -283,6 +283,7 @@ static void qeth_l2_dev2br_fdb_flush(struct qeth_card *card)
QETH_CARD_TEXT(card, 2, "fdbflush");
+ memset(&info, 0, sizeof(info));
info.addr = NULL;
/* flush all VLANs: */
info.vid = 0;
@@ -693,6 +694,7 @@ static void qeth_l2_dev2br_fdb_notify(struct qeth_card *card, u8 code,
if (qeth_is_my_net_if_token(card, token))
return;
+ memset(&info, 0, sizeof(info));
info.addr = ntfy_mac;
/* don't report VLAN IDs */
info.vid = 0;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 532085da8d8f..1cb7f7e56784 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -2298,6 +2298,7 @@ dsa_fdb_offload_notify(struct dsa_switchdev_event_work *switchdev_work)
if (!dsa_is_user_port(ds, switchdev_work->port))
return;
+ memset(&info, 0, sizeof(info));
info.addr = switchdev_work->addr;
info.vid = switchdev_work->vid;
info.offloaded = true;
--
2.25.1
Powered by blists - more mailing lists