Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac4c8868 authored by Toshiaki Makita's avatar Toshiaki Makita Committed by David S. Miller
Browse files

bridge: Prevent possible race condition in br_fdb_change_mac_address 



br_fdb_change_mac_address() calls fdb_insert()/fdb_delete() without
br->hash_lock.

These hash list updates are racy with br_fdb_update()/br_fdb_cleanup().

Signed-off-by: default avatarToshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: default avatarVlad Yasevich <vyasevic@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 424bb9c9

net/bridge/br_fdb.c

+5 −1
Original line number Diff line number Diff line
@@ -191,6 +191,8 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr) 
	struct net_port_vlans *pv;

	u16 vid = 0;



	spin_lock_bh(&br->hash_lock);



	/* If old entry was unassociated with any port, then delete it. */

	f = __br_fdb_get(br, br->dev->dev_addr, 0);

	if (f && f->is_local && !f->dst)
@@ -204,7 +206,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr) 
	 */

	pv = br_get_vlan_info(br);

	if (!pv)

		return;

		goto out;



	for_each_set_bit_from(vid, pv->vlan_bitmap, VLAN_N_VID) {

		f = __br_fdb_get(br, br->dev->dev_addr, vid);
@@ -212,6 +214,8 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr) 
			fdb_delete_local(br, NULL, f);

		fdb_insert(br, NULL, newaddr, vid);

	}

out:

	spin_unlock_bh(&br->hash_lock);

}



void br_fdb_cleanup(unsigned long _data)