Commit 468e7944 authored Sep 30, 2015 by Nikolay Aleksandrov Committed by David S. Miller Oct 01, 2015

bridge: vlan: fix possible null vlgrp deref while registering new port



While a new port is being initialized the rx_handler gets set, but the
vlans get initialized later in br_add_if() and in that window if we
receive a frame with a link-local address we can try to dereference
p->vlgrp in:
br_handle_frame() -> br_handle_local_finish() -> br_should_learn()

Fix this by checking vlgrp before using it.

Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 8af78b64

net/bridge/br_vlan.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -476,13 +476,15 @@ bool br_allowed_egress(struct net_bridge_vlan_group *vg,
		/* Called under RCU */
		bool br_should_learn(struct net_bridge_port p, struct sk_buff skb, u16 *vid)
		{
		struct net_bridge_vlan_group *vg;
		struct net_bridge *br = p->br;

		/* If filtering was disabled at input, let it pass. */
		if (!br->vlan_enabled)
		return true;

		if (!p->vlgrp->num_vlans)
		vg = p->vlgrp;
		if (!vg \|\| !vg->num_vlans)
		return false;

		if (!br_vlan_get_tag(skb, vid) && skb->vlan_proto != br->vlan_proto)