Commit 2fdeee25 authored Feb 11, 2019 by Cong Wang Committed by David S. Miller Feb 12, 2019

team: avoid complex list operations in team_nl_cmd_options_set()



The current opt_inst_list operations inside team_nl_cmd_options_set()
is too complex to track:

    LIST_HEAD(opt_inst_list);
    nla_for_each_nested(...) {
        list_for_each_entry(opt_inst, &team->option_inst_list, list) {
            if (__team_option_inst_tmp_find(&opt_inst_list, opt_inst))
                continue;
            list_add(&opt_inst->tmp_list, &opt_inst_list);
        }
    }
    team_nl_send_event_options_get(team, &opt_inst_list);

as while we retrieve 'opt_inst' from team->option_inst_list, it could
be added to the local 'opt_inst_list' for multiple times. The
__team_option_inst_tmp_find() doesn't work, as the setter
team_mode_option_set() still calls team->ops.exit() which uses
->tmp_list too in __team_options_change_check().

Simplify the list operations by moving the 'opt_inst_list' and
team_nl_send_event_options_get() into the nla_for_each_nested() loop so
that it can be guranteed that we won't insert a same list entry for
multiple times. Therefore, __team_option_inst_tmp_find() can be removed
too.

Fixes: 4fb0534f ("team: avoid adding twice the same option to the event list")
Fixes: 2fcdb2c9 ("team: allow to send multiple set events in one message")
Reported-by:  <syzbot+4d4af685432dc0e56c91@syzkaller.appspotmail.com>
Reported-by:  <syzbot+68ee510075cf64260cc4@syzkaller.appspotmail.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Cc: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Reviewed-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a090d794

drivers/net/team/team.c

+5 −22

Original line number	Diff line number	Diff line
		@@ -256,17 +256,6 @@ static void __team_option_inst_mark_removed_port(struct team *team,
		}
		}

		static bool __team_option_inst_tmp_find(const struct list_head *opts,
		const struct team_option_inst *needle)
		{
		struct team_option_inst *opt_inst;

		list_for_each_entry(opt_inst, opts, tmp_list)
		if (opt_inst == needle)
		return true;
		return false;
		}

		static int __team_options_register(struct team *team,
		const struct team_option *option,
		size_t option_count)
		@@ -2460,7 +2449,6 @@ static int team_nl_cmd_options_set(struct sk_buff skb, struct genl_info info)
		int err = 0;
		int i;
		struct nlattr *nl_option;
		LIST_HEAD(opt_inst_list);

		rtnl_lock();

		@@ -2480,6 +2468,7 @@ static int team_nl_cmd_options_set(struct sk_buff skb, struct genl_info info)
		struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1];
		struct nlattr *attr;
		struct nlattr *attr_data;
		LIST_HEAD(opt_inst_list);
		enum team_option_type opt_type;
		int opt_port_ifindex = 0; /* != 0 for per-port options */
		u32 opt_array_index = 0;
		@@ -2584,23 +2573,17 @@ static int team_nl_cmd_options_set(struct sk_buff skb, struct genl_info info)
		if (err)
		goto team_put;
		opt_inst->changed = true;

		/* dumb/evil user-space can send us duplicate opt,
		* keep only the last one
		*/
		if (__team_option_inst_tmp_find(&opt_inst_list,
		opt_inst))
		continue;

		list_add(&opt_inst->tmp_list, &opt_inst_list);
		}
		if (!opt_found) {
		err = -ENOENT;
		goto team_put;
		}
		}

		err = team_nl_send_event_options_get(team, &opt_inst_list);
		if (err)
		break;
		}

		team_put:
		team_nl_team_put(team);