github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-30 14:06:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
8ed67535fd
linux/net/bridge
History
Nikolay Aleksandrov 18a6fe05fb net: bridge: mst: move switchdev call outside rcu 
This is a follow-up of one of sashiko's pre-existing bug reports.
br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs
while holding rcu_read_lock() which invokes the blocking switchdev
notifier chain and may sleep. Nonzero MSTI changes come from netlink
with rtnl held. Move the switchdev call before entering the rcu section and
assert that rtnl is held.

The call cannot be deferred because netlink needs its error and extack.
Also DSA reads the old bridge MST state during the callback and checks it.
A deferred callback will be late and will see the updated state.

Fixes: 3a7c1661ae ("net: bridge: mst: fix vlan use-after-free")
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260911105021.1385934-1-razor@blackwall.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-15 12:27:41 +02:00
..
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
br_arp_nd_proxy.c net: bridge: arp/nd proxy: fix reading neigh ha 2026-08-20 14:23:06 -07:00
br_cfm_netlink.c bridge: cfm: reject invalid CCM interval at configuration time 2026-06-11 15:16:12 -07:00
br_cfm.c net: bridge: use option bits for CFM/MRP frame handlers 2026-09-08 17:48:49 -07:00
br_device.c net: bridge: use option bits for CFM/MRP frame handlers 2026-09-08 17:48:49 -07:00
br_fdb.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_forward.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_if.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-06-30 15:14:35 +02:00
br_input.c net: bridge: use option bits for CFM/MRP frame handlers 2026-09-08 17:48:49 -07:00
br_ioctl.c bridge: provide lockless access to p->config_pending 2026-06-05 17:46:18 -07:00
br_mdb.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
br_mrp_netlink.c net: bridge: use atomic ops to read/change p->flags (II) 2026-06-12 18:03:46 -07:00
br_mrp_switchdev.c
br_mrp.c net: bridge: use option bits for CFM/MRP frame handlers 2026-09-08 17:48:49 -07:00
br_mst.c net: bridge: mst: move switchdev call outside rcu 2026-09-15 12:27:41 +02:00
br_multicast_eht.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
br_multicast.c net: bridge: mcast: properly convert mglist to rcu 2026-09-04 15:29:47 -07:00
br_netfilter_hooks.c netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() 2026-05-16 13:22:50 +02:00
br_netfilter_ipv6.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
br_netlink_tunnel.c net: bridge: Reject descending VLAN tunnel ranges 2026-08-20 11:32:44 -07:00
br_netlink.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_nf_core.c bridge: netfilter: Fix forwarding of fragmented packets 2025-05-16 16:02:06 -07:00
br_private_cfm.h
br_private_mcast_eht.h
br_private_mrp.h
br_private_stp.h
br_private_tunnel.h bridge: always declare tunnel functions 2023-05-17 21:28:58 -07:00
br_private.h net: bridge: use option bits for CFM/MRP frame handlers 2026-09-08 17:48:49 -07:00
br_stp_bpdu.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_stp_if.c bridge: provide lockless access to p->config_pending 2026-06-05 17:46:18 -07:00
br_stp_timer.c bridge: add a READ_ONCE() in br_timer_value() 2026-06-05 17:46:16 -07:00
br_stp.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-06-30 15:14:35 +02:00
br_switchdev.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_sysfs_br.c mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
br_sysfs_if.c bridge: use atomic ops to read/change p->flags in sysfs 2026-06-12 18:03:45 -07:00
br_vlan_options.c net: bridge: vlan: fix vlan range dumps starting with pvid 2026-07-22 10:23:18 -07:00
br_vlan_tunnel.c bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress 2026-01-04 09:45:35 -08:00
br_vlan.c net: bridge: vlan: fix inverted default vlan notification 2026-08-17 18:27:14 -07:00
br.c net: remove unused ATM protocols and legacy ATM device drivers 2026-04-23 12:21:14 -07:00
Kconfig ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs 2026-03-29 11:21:22 -07:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00