[PATCH net-next 0/2] bridge: vlan: failure path and comment fixes

[PATCH net-next 0/2] bridge: vlan: failure path and comment fixes

[Nikolay Aleksandrov]

From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>

Hi,
This is a set from Ido which takes care of one failure path error in
nbp_vlan_init (patch 1) and a few comment errors (patch 2).
I must admit I didn't expect the port init continues after a vlan init
failure but should've checked to make sure. Thanks to Ido for catching
these!

Cheers,
 Nik

Ido Schimmel (2):
  bridge: vlan: Prevent possible use-after-free
  bridge: vlan: Use correct flag name in comment

 net/bridge/br_vlan.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

-- 
2.4.3

[PATCH net-next 1/2] bridge: vlan: Prevent possible use-after-free

[Nikolay Aleksandrov]

From: Ido Schimmel <idosch@mellanox.com>

When adding a port to a bridge we initialize VLAN filtering on it. We do
not bail out in case an error occurred in nbp_vlan_init, as it can be
used as a non VLAN filtering bridge.

However, if VLAN filtering is required and an error occurred in
nbp_vlan_init, we should set vlgrp to NULL, so that VLAN filtering
functions (e.g. br_vlan_find, br_get_pvid) will know the struct is
invalid and will not try to access it.

Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
---
 net/bridge/br_vlan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 5f0d0cc4744f..1054696323d7 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -914,6 +914,8 @@ out:
 	return ret;
 
 err_vlan_add:
+	RCU_INIT_POINTER(p->vlgrp, NULL);
+	synchronize_rcu();
 	rhashtable_destroy(&vg->vlan_hash);
 err_rhtbl:
 	kfree(vg);
-- 
2.4.3

[PATCH net-next 2/2] bridge: vlan: Use correct flag name in comment

[Nikolay Aleksandrov]

From: Ido Schimmel <idosch@mellanox.com>

The flag used to indicate if a VLAN should be used for filtering - as
opposed to context only - on the bridge itself (e.g. br0) is called
'brentry' and not 'brvlan'.

Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
---
 net/bridge/br_vlan.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 1054696323d7..dc1a2da55d09 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -180,11 +180,11 @@ static void br_vlan_put_master(struct net_bridge_vlan *masterv)
  * devices. There are four possible calls to this function in terms of the
  * vlan entry type:
  * 1. vlan is being added on a port (no master flags, global entry exists)
- * 2. vlan is being added on a bridge (both master and brvlan flags)
+ * 2. vlan is being added on a bridge (both master and brentry flags)
  * 3. vlan is being added on a port, but a global entry didn't exist which
- *    is being created right now (master flag set, brvlan flag unset), the
+ *    is being created right now (master flag set, brentry flag unset), the
  *    global entry is used for global per-vlan features, but not for filtering
- * 4. same as 3 but with both master and brvlan flags set so the entry
+ * 4. same as 3 but with both master and brentry flags set so the entry
  *    will be used for filtering in both the port and the bridge
  */
 static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
-- 
2.4.3

Re: [PATCH net-next 0/2] bridge: vlan: failure path and comment fixes

[David Miller]

From: Nikolay Aleksandrov <razor@blackwall.org>
Date: Fri, 30 Oct 2015 17:46:18 +0100

> This is a set from Ido which takes care of one failure path error in
> nbp_vlan_init (patch 1) and a few comment errors (patch 2).
> I must admit I didn't expect the port init continues after a vlan init
> failure but should've checked to make sure. Thanks to Ido for catching
> these!

Series applied, thanks.