* [Bridge] bridge: fix use-after-free in br_cleanup_bridges()
@ 2008-07-02 13:04 ` Patrick McHardy
0 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2008-07-02 13:04 UTC (permalink / raw)
To: David S. Miller; +Cc: Linux Netdev List, Stephen Hemminger, bridge
[-- Attachment #1: Type: text/plain, Size: 0 bytes --]
[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1403 bytes --]
commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
Author: Patrick McHardy <kaber@trash.net>
Date: Wed Jul 2 15:02:23 2008 +0200
bridge: fix use-after-free in br_cleanup_bridges()
Unregistering a bridge device may cause virtual devices stacked on the
bridge, like vlan or macvlan devices, to be unregistered as well.
br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
devices during cleanup. This is not enough however, if one of the
additionally unregistered devices is next in the list to the bridge
device, it will get freed as well and the iteration continues on
the freed element.
Restart iteration after each bridge device removal from the beginning to
fix this, similar to what rtnl_link_unregister() does.
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c2397f5..f38cc53 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
void __exit br_cleanup_bridges(void)
{
- struct net_device *dev, *nxt;
+ struct net_device *dev;
rtnl_lock();
- for_each_netdev_safe(&init_net, dev, nxt)
- if (dev->priv_flags & IFF_EBRIDGE)
+restart:
+ for_each_netdev(&init_net, dev) {
+ if (dev->priv_flags & IFF_EBRIDGE) {
del_br(dev->priv);
+ goto restart;
+ }
+ }
rtnl_unlock();
}
^ permalink raw reply related [flat|nested] 6+ messages in thread* bridge: fix use-after-free in br_cleanup_bridges()
@ 2008-07-02 13:04 ` Patrick McHardy
0 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2008-07-02 13:04 UTC (permalink / raw)
To: David S. Miller; +Cc: Stephen Hemminger, Linux Netdev List, bridge
[-- Attachment #1: Type: text/plain, Size: 0 bytes --]
[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1403 bytes --]
commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
Author: Patrick McHardy <kaber@trash.net>
Date: Wed Jul 2 15:02:23 2008 +0200
bridge: fix use-after-free in br_cleanup_bridges()
Unregistering a bridge device may cause virtual devices stacked on the
bridge, like vlan or macvlan devices, to be unregistered as well.
br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
devices during cleanup. This is not enough however, if one of the
additionally unregistered devices is next in the list to the bridge
device, it will get freed as well and the iteration continues on
the freed element.
Restart iteration after each bridge device removal from the beginning to
fix this, similar to what rtnl_link_unregister() does.
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c2397f5..f38cc53 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -442,12 +442,16 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
void __exit br_cleanup_bridges(void)
{
- struct net_device *dev, *nxt;
+ struct net_device *dev;
rtnl_lock();
- for_each_netdev_safe(&init_net, dev, nxt)
- if (dev->priv_flags & IFF_EBRIDGE)
+restart:
+ for_each_netdev(&init_net, dev) {
+ if (dev->priv_flags & IFF_EBRIDGE) {
del_br(dev->priv);
+ goto restart;
+ }
+ }
rtnl_unlock();
}
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Bridge] bridge: fix use-after-free in br_cleanup_bridges()
2008-07-02 13:04 ` Patrick McHardy
@ 2008-07-02 16:48 ` Stephen Hemminger
-1 siblings, 0 replies; 6+ messages in thread
From: Stephen Hemminger @ 2008-07-02 16:48 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Linux Netdev List, bridge, David S. Miller
On Wed, 02 Jul 2008 15:04:14 +0200
Patrick McHardy <kaber@trash.net> wrote:
> commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
> Author: Patrick McHardy <kaber@trash.net>
> Date: Wed Jul 2 15:02:23 2008 +0200
>
> bridge: fix use-after-free in br_cleanup_bridges()
>
> Unregistering a bridge device may cause virtual devices stacked on the
> bridge, like vlan or macvlan devices, to be unregistered as well.
> br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
> devices during cleanup. This is not enough however, if one of the
> additionally unregistered devices is next in the list to the bridge
> device, it will get freed as well and the iteration continues on
> the freed element.
>
> Restart iteration after each bridge device removal from the beginning to
> fix this, similar to what rtnl_link_unregister() does.
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: bridge: fix use-after-free in br_cleanup_bridges()
@ 2008-07-02 16:48 ` Stephen Hemminger
0 siblings, 0 replies; 6+ messages in thread
From: Stephen Hemminger @ 2008-07-02 16:48 UTC (permalink / raw)
To: Patrick McHardy; +Cc: David S. Miller, Linux Netdev List, bridge
On Wed, 02 Jul 2008 15:04:14 +0200
Patrick McHardy <kaber@trash.net> wrote:
> commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
> Author: Patrick McHardy <kaber@trash.net>
> Date: Wed Jul 2 15:02:23 2008 +0200
>
> bridge: fix use-after-free in br_cleanup_bridges()
>
> Unregistering a bridge device may cause virtual devices stacked on the
> bridge, like vlan or macvlan devices, to be unregistered as well.
> br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
> devices during cleanup. This is not enough however, if one of the
> additionally unregistered devices is next in the list to the bridge
> device, it will get freed as well and the iteration continues on
> the freed element.
>
> Restart iteration after each bridge device removal from the beginning to
> fix this, similar to what rtnl_link_unregister() does.
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Bridge] bridge: fix use-after-free in br_cleanup_bridges()
2008-07-02 16:48 ` Stephen Hemminger
@ 2008-07-03 10:54 ` David Miller
-1 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2008-07-03 10:54 UTC (permalink / raw)
To: shemminger; +Cc: netdev, bridge
From: Stephen Hemminger <shemminger@vyatta.com>
Date: Wed, 2 Jul 2008 09:48:17 -0700
> On Wed, 02 Jul 2008 15:04:14 +0200
> Patrick McHardy <kaber@trash.net> wrote:
>
> > commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
> > Author: Patrick McHardy <kaber@trash.net>
> > Date: Wed Jul 2 15:02:23 2008 +0200
> >
> > bridge: fix use-after-free in br_cleanup_bridges()
> >
> > Unregistering a bridge device may cause virtual devices stacked on the
> > bridge, like vlan or macvlan devices, to be unregistered as well.
> > br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
> > devices during cleanup. This is not enough however, if one of the
> > additionally unregistered devices is next in the list to the bridge
> > device, it will get freed as well and the iteration continues on
> > the freed element.
> >
> > Restart iteration after each bridge device removal from the beginning to
> > fix this, similar to what rtnl_link_unregister() does.
> >
> > Signed-off-by: Patrick McHardy <kaber@trash.net>
>
> Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Applied, thanks everyone.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: bridge: fix use-after-free in br_cleanup_bridges()
@ 2008-07-03 10:54 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2008-07-03 10:54 UTC (permalink / raw)
To: shemminger; +Cc: netdev, bridge
From: Stephen Hemminger <shemminger@vyatta.com>
Date: Wed, 2 Jul 2008 09:48:17 -0700
> On Wed, 02 Jul 2008 15:04:14 +0200
> Patrick McHardy <kaber@trash.net> wrote:
>
> > commit 96f1dd78dad10d61bdd487edadea6adda5425e4c
> > Author: Patrick McHardy <kaber@trash.net>
> > Date: Wed Jul 2 15:02:23 2008 +0200
> >
> > bridge: fix use-after-free in br_cleanup_bridges()
> >
> > Unregistering a bridge device may cause virtual devices stacked on the
> > bridge, like vlan or macvlan devices, to be unregistered as well.
> > br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
> > devices during cleanup. This is not enough however, if one of the
> > additionally unregistered devices is next in the list to the bridge
> > device, it will get freed as well and the iteration continues on
> > the freed element.
> >
> > Restart iteration after each bridge device removal from the beginning to
> > fix this, similar to what rtnl_link_unregister() does.
> >
> > Signed-off-by: Patrick McHardy <kaber@trash.net>
>
> Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Applied, thanks everyone.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2008-07-03 10:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-07-02 13:04 [Bridge] bridge: fix use-after-free in br_cleanup_bridges() Patrick McHardy
2008-07-02 13:04 ` Patrick McHardy
2008-07-02 16:48 ` [Bridge] " Stephen Hemminger
2008-07-02 16:48 ` Stephen Hemminger
2008-07-03 10:54 ` [Bridge] " David Miller
2008-07-03 10:54 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.