Hong Zhiguo 716ec052d2 bridge: fix NULL pointer deref of br_port_get_rcu ... The NULL deref happens when br_handle_frame is called between these 2 lines of del_nbp: dev->priv_flags &= ~IFF_BRIDGE_PORT; /* --> br_handle_frame is called at this time */ netdev_rx_handler_unregister(dev); In br_handle_frame the return of br_port_get_rcu(dev) is dereferenced without check but br_port_get_rcu(dev) returns NULL if: !(dev->priv_flags & IFF_BRIDGE_PORT) Eric Dumazet pointed out the testing of IFF_BRIDGE_PORT is not necessary here since we're in rcu_read_lock and we have synchronize_net() in netdev_rx_handler_unregister. So remove the testing of IFF_BRIDGE_PORT and by the previous patch, make sure br_port_get_rcu is called in bridging code. Signed-off-by: Hong Zhiguo <zhiguohong@tencent.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-09-15 22:03:33 -04:00
..
netfilter
br_device.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
br_fdb.c
br_forward.c
br_if.c
br_input.c
br_ioctl.c
br_mdb.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
br_multicast.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
br_netfilter.c
br_netlink.c	bridge: use br_port_get_rtnl within rtnl lock	2013-09-15 22:03:33 -04:00
br_notify.c
br_private_stp.h
br_private.h	bridge: fix NULL pointer deref of br_port_get_rcu	2013-09-15 22:03:33 -04:00
br_stp_bpdu.c
br_stp_if.c	bridge: Clamp forward_delay when enabling STP	2013-09-12 23:32:14 -04:00
br_stp_timer.c
br_stp.c	bridge: Clamp forward_delay when enabling STP	2013-09-12 23:32:14 -04:00
br_sysfs_br.c
br_sysfs_if.c
br_vlan.c
br.c
Kconfig
Makefile