Ido Schimmel e29066778b bridge: netlink: register netdevice before executing changelink ... [ Upstream commit 5b8d5429da ] Peter reported a kernel oops when executing the following command: $ ip link add name test type bridge vlan_default_pvid 1 [13634.939408] BUG: unable to handle kernel NULL pointer dereference at 0000000000000190 [13634.939436] IP: __vlan_add+0x73/0x5f0 [...] [13634.939783] Call Trace: [13634.939791] ? pcpu_next_unpop+0x3b/0x50 [13634.939801] ? pcpu_alloc+0x3d2/0x680 [13634.939810] ? br_vlan_add+0x135/0x1b0 [13634.939820] ? __br_vlan_set_default_pvid.part.28+0x204/0x2b0 [13634.939834] ? br_changelink+0x120/0x4e0 [13634.939844] ? br_dev_newlink+0x50/0x70 [13634.939854] ? rtnl_newlink+0x5f5/0x8a0 [13634.939864] ? rtnl_newlink+0x176/0x8a0 [13634.939874] ? mem_cgroup_commit_charge+0x7c/0x4e0 [13634.939886] ? rtnetlink_rcv_msg+0xe1/0x220 [13634.939896] ? lookup_fast+0x52/0x370 [13634.939905] ? rtnl_newlink+0x8a0/0x8a0 [13634.939915] ? netlink_rcv_skb+0xa1/0xc0 [13634.939925] ? rtnetlink_rcv+0x24/0x30 [13634.939934] ? netlink_unicast+0x177/0x220 [13634.939944] ? netlink_sendmsg+0x2fe/0x3b0 [13634.939954] ? _copy_from_user+0x39/0x40 [13634.939964] ? sock_sendmsg+0x30/0x40 [13634.940159] ? ___sys_sendmsg+0x29d/0x2b0 [13634.940326] ? __alloc_pages_nodemask+0xdf/0x230 [13634.940478] ? mem_cgroup_commit_charge+0x7c/0x4e0 [13634.940592] ? mem_cgroup_try_charge+0x76/0x1a0 [13634.940701] ? __handle_mm_fault+0xdb9/0x10b0 [13634.940809] ? __sys_sendmsg+0x51/0x90 [13634.940917] ? entry_SYSCALL_64_fastpath+0x1e/0xad The problem is that the bridge's VLAN group is created after setting the default PVID, when registering the netdevice and executing its ndo_init(). Fix this by changing the order of both operations, so that br_changelink() is only processed after the netdevice is registered, when the VLAN group is already initialized. Fixes: b6677449df ("bridge: netlink: call br_changelink() during br_dev_newlink()") Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: Ido Schimmel <idosch@mellanox.com> Reported-by: Peter V. Saveliev <peter@svinota.eu> Tested-by: Peter V. Saveliev <peter@svinota.eu> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-10-08 10:14:19 +02:00
..
6lowpan	6lowpan: put mcast compression in an own function	2015-10-21 00:49:25 +02:00
9p	p9_client_readdir() fix	2017-05-02 21:19:55 -07:00
802
8021q	vlan: Propagate MAC address to VLANs	2017-08-06 19:19:43 -07:00
appletalk
atm
ax25	ax25: Fix segfault after sock connection timeout	2017-02-04 09:45:09 +01:00
batman-adv	batman-adv: Check for alloc errors when preparing TT local data	2016-12-15 08:49:23 -08:00
bluetooth	Bluetooth: Properly check L2CAP config option output buffer length	2017-09-13 14:09:46 -07:00
bridge	bridge: netlink: register netdevice before executing changelink	2017-10-08 10:14:19 +02:00
caif	net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx	2017-07-05 14:37:14 +02:00
can	can: Fix kernel panic at security_sock_rcv_skb	2017-02-18 16:39:26 +01:00
ceph	libceph: force GFP_NOIO for socket allocations	2017-04-08 09:53:30 +02:00
core	net: core: Prevent from dereferencing null pointer when releasing SKB	2017-10-08 10:14:18 +02:00
dcb	net/dcb: make dcbnl.c explicitly non-modular	2015-10-09 07:52:27 -07:00
dccp	dccp: defer ccid_hc_tx_delete() at dismantle time	2017-08-30 10:19:18 +02:00
decnet	decnet: always not take dst->__refcnt when inserting dst into hash table	2017-07-05 14:37:14 +02:00
dns_resolver	net: dns_resolver: convert time_t to time64_t	2015-11-18 16:27:46 -05:00
dsa	net: dsa: Check return value of phy_connect_direct()	2017-07-05 14:37:19 +02:00
ethernet	net: introduce device min_header_len	2017-02-18 16:39:27 +01:00
hsr	net/hsr: fix a warning message	2015-11-23 14:56:15 -05:00
ieee802154	Revert "net: fix percpu memory leaks"	2017-09-27 11:00:11 +02:00
ipv4	Revert "net: fix percpu memory leaks"	2017-09-27 11:00:11 +02:00
ipv6	ipv6: fix typo in fib6_net_exit()	2017-09-27 11:00:12 +02:00
ipx	ipx: call ipxitf_put() in ioctl error path	2017-05-25 14:30:13 +02:00
irda	irda: do not leak initialized list.dev to userspace	2017-08-30 10:19:21 +02:00
iucv	af_iucv: Validate socket address length in iucv_sock_bind()	2016-03-03 15:07:03 -08:00
key	af_key: do not use GFP_KERNEL in atomic contexts	2017-08-30 10:19:18 +02:00
l2tp	l2tp: fix PPP pseudo-wire auto-loading	2017-05-02 21:19:52 -07:00
l3mdev	net: Add netif_is_l3_slave	2015-10-07 04:27:43 -07:00
lapb
llc	net/llc: avoid BUG_ON() in skb_orphan()	2017-02-26 11:07:49 +01:00
mac80211	mac80211: flush hw_roc_start work before cancelling the ROC	2017-10-05 09:41:44 +02:00
mac802154	mac802154: llsec: use kzfree	2015-10-21 00:49:24 +02:00
mpls	mpls: Send route delete notifications when router module is unloaded	2017-03-22 12:04:16 +01:00
netfilter	netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister	2017-08-24 17:02:34 -07:00
netlabel	netlabel: add address family checks to netlbl_{sock,req}_delattr()	2016-08-20 18:09:22 +02:00
netlink	netlink: Allow direct reclaim for fallback allocation	2017-05-08 07:46:02 +02:00
netrom
nfc	NFC: Add sockaddr length checks before accessing sa_family in bind handlers	2017-07-27 15:06:03 -07:00
openvswitch	openvswitch: fix potential out of bound access in parse_ct	2017-08-11 09:08:53 -07:00
packet	net/packet: check length in getsockopt() called with PACKET_HDRLEN	2017-10-08 10:14:18 +02:00
phonet	phonet: properly unshare skbs in phonet_rcv()	2016-01-31 11:29:00 -08:00
rds	RDS: RDMA: Fix the composite message user notification	2017-10-08 10:14:16 +02:00
rfkill	rfkill: fix rfkill_fop_read wait_event usage	2016-03-03 15:07:26 -08:00
rose
rxrpc	rxrpc: Fix several cases where a padded len isn't checked in ticket decode	2017-06-29 12:48:52 +02:00
sched	net: sched: fix NULL pointer dereference when action calls some targets	2017-08-30 10:19:21 +02:00
sctp	sctp: fully initialize the IPv6 address in sctp_v6_to_addr()	2017-08-30 10:19:19 +02:00
sunrpc	SUNRPC: fix refcounting problems with auth_gss messages.	2017-04-21 09:30:08 +02:00
switchdev	switchdev: pass pointer to fib_info instead of copy	2016-06-24 10:18:16 -07:00
tipc	tipc: fix use-after-free	2017-08-30 10:19:20 +02:00
unix	af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers	2017-07-05 14:37:13 +02:00
vmw_vsock	VSOCK: Detach QP check should filter out non matching QPs.	2017-04-27 09:09:32 +02:00
wimax
wireless	nl80211: check for the required netlink attributes presence	2017-10-05 09:41:46 +02:00
x25	net: fix a kernel infoleak in x25 module	2016-05-18 17:06:43 -07:00
xfrm	xfrm: policy: check policy direction value	2017-09-07 08:34:09 +02:00
compat.c	audit: log 32-bit socketcalls	2017-10-08 10:14:18 +02:00
Kconfig	net: Introduce L3 Master device abstraction	2015-09-29 20:40:32 -07:00
Makefile	net: Introduce L3 Master device abstraction	2015-09-29 20:40:32 -07:00
socket.c	net: socket: fix recvmmsg not returning error from sock_error	2017-02-26 11:07:50 +01:00
sysctl_net.c	net: Use ns_capable_noaudit() when determining net sysctl permissions	2016-09-15 08:27:50 +02:00