Re: [Bridge] [patch] rstpd crashes with GARP/GMRP packets

[Solomon Peachy <solomon@linux-wlan.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1160 bytes --]

Whoops, the correct patch is attached.

On Thu, Jul 03, 2008 at 11:53:06AM +0530, Srinivas M.A. wrote:
> This looks like the earlier patch, for NETLINK size fixes. Could you
> resend the intended patch. Thanks.
>
> On Thu, Jul 3, 2008 at 4:39 AM, Solomon Peachy <solomon@linux-wlan.com> wrote:
> > The attached patch, against Shrinivas's May 7, 2008 snapshot, fixes a
> > null pointer dereference that occurs when we receive a packet from the
> > brige interface that bears the STP MACADDR, but is *not* a STP packet.
> >
> > Specifically, I was receiving GMRP packets (see 802.1D-2004 10.1) from a
> > 3Com switch.
> >
> > I don't know what we should do with these -- but crashing isn't it.  I
> > can send over a packet dump and more debugging info if desired.
> 
> Looks like we aren't validating the BPDU as we should be. Please send
> any debugging information you have.

-- 
Solomon Peachy                        solomon@linux-wlan.com
AbsoluteValue Systems                 http://www.linux-wlan.com
721-D North Drive                     +1 (321) 259-0737  (office)
Melbourne, FL 32934                   +1 (321) 259-0286  (fax)

[-- Attachment #1.2: rstpd_crash_fix.diff --]
[-- Type: text/plain, Size: 503 bytes --]

diff --git a/packages/foss/rstp/bridge_track.c b/packages/foss/rstp/bridge_track.c
index e93c014..becfff6 100644
--- a/packages/foss/rstp/bridge_track.c
+++ b/packages/foss/rstp/bridge_track.c
@@ -448,6 +448,12 @@ void bridge_bpdu_rcv(int if_index, const unsigned char *data, int len)
 		return;
 
 	TST(ifc->up,);
+
+	/* Note, we can receive packets via the bridge interface 
+	   that are not STP, eg GMRP */
+	if (!ifc->master) 
+		return;
+
 	if (!ifc->master->stp_up)
 		return;
 

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]