Nikolay Aleksandrov fc7fdd8c5c net: bridge: fix vlan tunnel dst refcnt when egressing ... commit cfc579f9d8 upstream. The egress tunnel code uses dst_clone() and directly sets the result which is wrong because the entry might have 0 refcnt or be already deleted, causing number of problems. It also triggers the WARN_ON() in dst_hold()[1] when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and checking if a reference was actually taken before setting the dst. [1] dmesg WARN_ON log and following refcnt errors WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49 RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0 RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001 R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401 FS: 0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0 Call Trace: br_handle_vlan+0xbc/0xca [bridge] __br_forward+0x23/0x164 [bridge] deliver_clone+0x41/0x48 [bridge] br_handle_frame_finish+0x36f/0x3aa [bridge] ? skb_dst+0x2e/0x38 [bridge] ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge] ? br_handle_frame_finish+0x3aa/0x3aa [bridge] br_handle_frame+0x2c3/0x377 [bridge] ? __skb_pull+0x33/0x51 ? vlan_do_receive+0x4f/0x36a ? br_handle_frame_finish+0x3aa/0x3aa [bridge] __netif_receive_skb_core+0x539/0x7c6 ? __list_del_entry_valid+0x16e/0x1c2 __netif_receive_skb_list_core+0x6d/0xd6 netif_receive_skb_list_internal+0x1d9/0x1fa gro_normal_list+0x22/0x3e dev_gro_receive+0x55b/0x600 ? detach_buf_split+0x58/0x140 napi_gro_receive+0x94/0x12e virtnet_poll+0x15d/0x315 [virtio_net] __napi_poll+0x2c/0x1c9 net_rx_action+0xe6/0x1fb __do_softirq+0x115/0x2d8 run_ksoftirqd+0x18/0x20 smpboot_thread_fn+0x183/0x19c ? smpboot_unregister_percpu_thread+0x66/0x66 kthread+0x10a/0x10f ? kthread_mod_delayed_work+0xb6/0xb6 ret_from_fork+0x22/0x30 ---[ end trace 49f61b07f775fd2b ]--- dst_release: dst:00000000c02d677a refcnt:-1 dst_release underflow Cc: stable@vger.kernel.org Fixes: 11538d039a ("bridge: vlan dst_metadata hooks in ingress and egress paths") Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-06-23 14:42:53 +02:00
..
6lowpan
9p	net: 9p: advance iov on empty read	2021-04-07 15:00:08 +02:00
802
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:16:55 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25
batman-adv	batman-adv: Avoid WARN_ON timing related checks	2021-06-23 14:42:41 +02:00
bluetooth	Bluetooth: use correct lock to prevent UAF of hdev object	2021-06-10 13:39:23 +02:00
bpf	bpf: Reject too big ctx_size_in for raw_tp test run	2021-01-27 11:55:07 +01:00
bpfilter	Revert "bpfilter: Fix build error with CONFIG_BPFILTER_UMH"	2020-10-15 12:33:24 -07:00
bridge	net: bridge: fix vlan tunnel dst refcnt when egressing	2021-06-23 14:42:53 +02:00
caif	net: caif: fix memory leak in cfusbl_device_notify	2021-06-10 13:39:25 +02:00
can	can: j1939: fix Use-after-Free, hold skb ref while in use	2021-06-23 14:42:50 +02:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	net: make get_net_ns return error if NET_NS is disabled	2021-06-23 14:42:44 +02:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	ipv6: weaken the v4mapped source check	2021-03-30 14:32:01 +02:00
decnet
dns_resolver
dsa	net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs	2021-06-10 13:39:17 +02:00
ethernet
ethtool	ethtool: strset: fix message length calculation	2021-06-23 14:42:45 +02:00
hsr	net: hsr: fix mac_len checks	2021-06-03 09:00:50 +02:00
ieee802154	net: ieee802154: fix null deref in parse dev addr	2021-06-18 10:00:03 +02:00
ife
ipv4	icmp: don't send out ICMP messages with a source address of 0.0.0.0	2021-06-23 14:42:47 +02:00
ipv6	udp: fix race between close() and udp_abort()	2021-06-23 14:42:42 +02:00
iucv	net/af_iucv: remove WARN_ONCE on malformed RX packets	2021-03-07 12:34:05 +01:00
kcm
key	af_key: relax availability checks for skb size calculation	2021-02-13 13:55:02 +01:00
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-17 17:06:11 +01:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc
mac80211	mac80211: Fix NULL ptr deref for injected rate info	2021-06-23 14:42:52 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-14 08:42:13 +02:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-17 17:06:11 +01:00
mptcp	mptcp: do not warn on bad input from the network	2021-06-23 14:42:43 +02:00
ncsi	net/ncsi: Avoid channel_monitor hrtimer deadlock	2021-04-14 08:42:08 +02:00
netfilter	netfilter: synproxy: Fix out of bounds when parsing TCP options	2021-06-23 14:42:43 +02:00
netlabel	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
netlink	netlink: disable IRQs for netlink_lock_table()	2021-06-16 12:01:36 +02:00
netrom
nfc	net/nfc/rawsock.c: fix a permission check bug	2021-06-16 12:01:35 +02:00
nsh
openvswitch	openvswitch: meter: fix race when getting now_ms.	2021-06-03 09:00:47 +02:00
packet	net: packetmmap: fix only tx timestamp on request	2021-06-03 09:00:46 +02:00
phonet
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net: qrtr: fix OOB Read in qrtr_endpoint_post	2021-06-23 14:42:45 +02:00
rds	net: rds: fix memory leak in rds_recvmsg	2021-06-23 14:42:42 +02:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix clearance of Tx/Rx ring when releasing a call	2021-02-17 11:02:28 +01:00
sched	sch_cake: Fix out of bounds when parsing TCP options and header	2021-06-23 14:42:43 +02:00
sctp	sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b	2021-05-19 10:13:06 +02:00
smc	net/smc: remove device from smcd_dev_list after failed device_add()	2021-06-03 09:00:48 +02:00
strparser
sunrpc	SUNRPC: More fixes for backlog congestion	2021-06-03 09:00:51 +02:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: fix unique bearer names sanity check	2021-06-10 13:39:22 +02:00
tls	net/tls: Fix use-after-free after the TLS device goes down and up	2021-06-10 13:39:18 +02:00
unix	net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock	2021-06-23 14:42:46 +02:00
vmw_vsock	vsock/virtio: free queued packets when closing socket	2021-05-14 09:50:41 +02:00
wimax
wireless	cfg80211: avoid double free of PMSR request	2021-06-23 14:42:53 +02:00
x25	net/x25: Return the correct errno code	2021-06-18 10:00:06 +02:00
xdp	xsk: Fix for xp_aligned_validate_desc() when len == chunk_size	2021-05-19 10:13:06 +02:00
xfrm	xfrm: BEET mode doesn't support fragments for inner packets	2021-04-21 13:00:51 +02:00
compat.c	net: Return the correct errno code	2021-06-18 10:00:06 +02:00
devres.c
Kconfig
Makefile
socket.c	net: make get_net_ns return error if NET_NS is disabled	2021-06-23 14:42:44 +02:00
sysctl_net.c