From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.14 15/17] net: bridge: fix old ioctl unlocked net device walk
Date: Mon, 16 May 2016 18:14:16 -0700 [thread overview]
Message-ID: <20160517011347.533182775@linuxfoundation.org> (raw)
In-Reply-To: <20160517011346.950684325@linuxfoundation.org>
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
[ Upstream commit 31ca0458a61a502adb7ed192bf9716c6d05791a5 ]
get_bridge_ifindices() is used from the old "deviceless" bridge ioctl
calls which aren't called with rtnl held. The comment above says that it is
called with rtnl but that is not really the case.
Here's a sample output from a test ASSERT_RTNL() which I put in
get_bridge_ifindices and executed "brctl show":
[ 957.422726] RTNL: assertion failed at net/bridge//br_ioctl.c (30)
[ 957.422925] CPU: 0 PID: 1862 Comm: brctl Tainted: G W O
4.6.0-rc4+ #157
[ 957.423009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.8.1-20150318_183358- 04/01/2014
[ 957.423009] 0000000000000000 ffff880058adfdf0 ffffffff8138dec5
0000000000000400
[ 957.423009] ffffffff81ce8380 ffff880058adfe58 ffffffffa05ead32
0000000000000001
[ 957.423009] 00007ffec1a444b0 0000000000000400 ffff880053c19130
0000000000008940
[ 957.423009] Call Trace:
[ 957.423009] [<ffffffff8138dec5>] dump_stack+0x85/0xc0
[ 957.423009] [<ffffffffa05ead32>]
br_ioctl_deviceless_stub+0x212/0x2e0 [bridge]
[ 957.423009] [<ffffffff81515beb>] sock_ioctl+0x22b/0x290
[ 957.423009] [<ffffffff8126ba75>] do_vfs_ioctl+0x95/0x700
[ 957.423009] [<ffffffff8126c159>] SyS_ioctl+0x79/0x90
[ 957.423009] [<ffffffff8163a4c0>] entry_SYSCALL_64_fastpath+0x23/0xc1
Since it only reads bridge ifindices, we can use rcu to safely walk the net
device list. Also remove the wrong rtnl comment above.
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/br_ioctl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -21,18 +21,19 @@
#include <asm/uaccess.h>
#include "br_private.h"
-/* called with RTNL */
static int get_bridge_ifindices(struct net *net, int *indices, int num)
{
struct net_device *dev;
int i = 0;
- for_each_netdev(net, dev) {
+ rcu_read_lock();
+ for_each_netdev_rcu(net, dev) {
if (i >= num)
break;
if (dev->priv_flags & IFF_EBRIDGE)
indices[i++] = dev->ifindex;
}
+ rcu_read_unlock();
return i;
}
next prev parent reply other threads:[~2016-05-17 2:03 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-17 1:14 [PATCH 3.14 00/17] 3.14.70-stable review Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 01/17] crypto: hash - Fix page length clamping in hash walk Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 02/17] get_rock_ridge_filename(): handle malformed NM entries Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 03/17] Input: max8997-haptic - fix NULL pointer dereference Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 04/17] asmlinkage, pnp: Make variables used from assembler code visible Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 05/17] drm/radeon: fix PLL sharing on DCE6.1 (v2) Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 06/17] drm/i915: Bail out of pipe config compute loop on LPT Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 07/17] ARM: OMAP3: Fix booting with thumb2 kernel Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 08/17] decnet: Do not build routes to devices without decnet private data Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 09/17] route: do not cache fib route info on local routes with oif Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 10/17] packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 11/17] atl2: Disable unimplemented scatter/gather feature Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 14/17] VSOCK: do not disconnect socket when peer has shutdown SEND only Greg Kroah-Hartman
2016-05-17 1:14 ` Greg Kroah-Hartman [this message]
2016-05-17 1:14 ` [PATCH 3.14 16/17] net: fix a kernel infoleak in x25 module Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 3.14 17/17] arm64: Make arch_randomize_brk avoid stack area Greg Kroah-Hartman
2016-05-17 9:49 ` Jon Medhurst (Tixy)
2016-05-17 20:31 ` Greg Kroah-Hartman
2016-05-17 4:06 ` [PATCH 3.14 00/17] 3.14.70-stable review Guenter Roeck
2016-05-17 20:32 ` Greg Kroah-Hartman
2016-05-17 17:25 ` Guenter Roeck
2016-05-17 20:32 ` Greg Kroah-Hartman
2016-05-17 17:27 ` Shuah Khan
2016-05-17 20:32 ` Greg Kroah-Hartman
[not found] ` <573c2d28.22c8c20a.9712f.4ddf@mx.google.com>
[not found] ` <m2k2iqzp1b.fsf@baylibre.com>
2016-05-19 3:53 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160517011347.533182775@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=nikolay@cumulusnetworks.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).