Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1691456

[PATCH 4.11 11/88] mlxsw: spectrum_router: Fix NULL pointer dereference

Show all headers | View raw

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ido Schimmel <idosch@mellanox.com>


[ Upstream commit 6b27c8adf27edf1dabe2cdcfaa101ef7e2712415 ]

In case a VLAN device is enslaved to a bridge we shouldn't create a
router interface (RIF) for it when it's configured with an IP address.
This is already handled by the driver for other types of netdevs, such
as physical ports and LAG devices.

If this IP address is then removed and the interface is subsequently
unlinked from the bridge, a NULL pointer dereference can happen, as the
original 802.1d FID was replaced with an rFID which was then deleted.

To reproduce:
$ ip link set dev enp3s0np9 up
$ ip link add name enp3s0np9.111 link enp3s0np9 type vlan id 111
$ ip link set dev enp3s0np9.111 up
$ ip link add name br0 type bridge
$ ip link set dev br0 up
$ ip link set enp3s0np9.111 master br0
$ ip address add dev enp3s0np9.111 192.168.0.1/24
$ ip address del dev enp3s0np9.111 192.168.0.1/24
$ ip link set dev enp3s0np9.111 nomaster

Fixes: 99724c18fc66 ("mlxsw: spectrum: Introduce support for router interfaces")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Petr Machata <petrm@mellanox.com>
Tested-by: Petr Machata <petrm@mellanox.com>
Reviewed-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -3829,6 +3829,9 @@ static int mlxsw_sp_inetaddr_vlan_event(
 	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(vlan_dev);
 	u16 vid = vlan_dev_vlan_id(vlan_dev);
 
+	if (netif_is_bridge_port(vlan_dev))
+		return 0;
+
 	if (mlxsw_sp_port_dev_check(real_dev))
 		return mlxsw_sp_inetaddr_vport_event(vlan_dev, real_dev, event,
 						     vid);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.11 00/88] 4.11.12-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 23/88] vrf: fix bug_on triggered by rx when destroying a vrf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 35/88] block: Fix a blk_exit_rl() regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 11/88] mlxsw: spectrum_router: Fix NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 26/88] cxgb4: fix BUG() on interrupt deallocating path of ULD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 21/88] liquidio: fix bug in soft reset failure detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 13/88] bpf: prevent leaking pointer via xadd on unpriviledged Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 03/88] netvsc: dont access netdev->num_rx_queues directly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  [PATCH 4.11 12/88] rocker: move dereference before free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 12:50 +0200
  Re: [PATCH 4.11 00/88] 4.11.12-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-19 22:40 +0200
  Re: [PATCH 4.11 00/88] 4.11.12-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-20 01:40 +0200

csiph-web