Hong Zhiguo 716ec052d2 bridge: fix NULL pointer deref of br_port_get_rcu ... The NULL deref happens when br_handle_frame is called between these 2 lines of del_nbp: dev->priv_flags &= ~IFF_BRIDGE_PORT; /* --> br_handle_frame is called at this time */ netdev_rx_handler_unregister(dev); In br_handle_frame the return of br_port_get_rcu(dev) is dereferenced without check but br_port_get_rcu(dev) returns NULL if: !(dev->priv_flags & IFF_BRIDGE_PORT) Eric Dumazet pointed out the testing of IFF_BRIDGE_PORT is not necessary here since we're in rcu_read_lock and we have synchronize_net() in netdev_rx_handler_unregister. So remove the testing of IFF_BRIDGE_PORT and by the previous patch, make sure br_port_get_rcu is called in bridging code. Signed-off-by: Hong Zhiguo <zhiguohong@tencent.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-09-15 22:03:33 -04:00
..
netfilter	PTR_RET is now PTR_ERR_OR_ZERO(): Replace most.	2013-07-15 11:25:01 +09:30
br_device.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
br_fdb.c	bridge: Use the correct bit length for bitmap functions in the VLAN code	2013-08-20 23:35:57 -07:00
br_forward.c	bridge: Add a flag to control unicast packet flood.	2013-06-11 02:04:32 -07:00
br_if.c	bridge: inherit slave devices needed_headroom	2013-08-29 15:17:09 -04:00
br_input.c	bridge: separate querier and query timer into IGMP/IPv4 and MLD/IPv6 ones	2013-08-30 15:24:37 -04:00
br_ioctl.c
br_mdb.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
br_multicast.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-05 14:58:52 -04:00
br_netfilter.c	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
br_netlink.c	bridge: use br_port_get_rtnl within rtnl lock	2013-09-15 22:03:33 -04:00
br_notify.c	net: convert resend IGMP to notifier event	2013-07-23 16:52:47 -07:00
br_private_stp.h
br_private.h	bridge: fix NULL pointer deref of br_port_get_rcu	2013-09-15 22:03:33 -04:00
br_stp_bpdu.c
br_stp_if.c	bridge: Clamp forward_delay when enabling STP	2013-09-12 23:32:14 -04:00
br_stp_timer.c	bridge: fix race with topology change timer	2013-05-03 16:08:58 -04:00
br_stp.c	bridge: Clamp forward_delay when enabling STP	2013-09-12 23:32:14 -04:00
br_sysfs_br.c	bridge: correct the comment for file br_sysfs_br.c	2013-08-07 10:35:06 -07:00
br_sysfs_if.c	bridge: Add a flag to control unicast packet flood.	2013-06-11 02:04:32 -07:00
br_vlan.c	bridge: Use the correct bit length for bitmap functions in the VLAN code	2013-08-20 23:35:57 -07:00
br.c
Kconfig
Makefile