diff options
| author | Felix Fietkau <nbd@nbd.name> | 2022-05-31 14:01:21 +0200 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2022-06-07 22:28:59 +0200 |
| commit | 8e9eaef70a444348fd8f90fbe26a07e1ad564972 (patch) | |
| tree | 235001707fccd02e778027ed53b5fc6eb691c4a1 /target | |
| parent | 33df033b73365487c5bb5a58b77aed04d4ca6ac1 (diff) | |
| download | upstream-8e9eaef70a444348fd8f90fbe26a07e1ad564972.tar.gz upstream-8e9eaef70a444348fd8f90fbe26a07e1ad564972.tar.bz2 upstream-8e9eaef70a444348fd8f90fbe26a07e1ad564972.zip | |
kernel: fix crashes in bridge offload code
- fix an issues when accessing the port pointer of an expired/invalid fdb entry
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 38a5b593ef9e94deedefb627f1952b3bb881df56)
Diffstat (limited to 'target')
| -rw-r--r-- | target/linux/generic/hack-5.10/600-bridge_offload.patch | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/target/linux/generic/hack-5.10/600-bridge_offload.patch b/target/linux/generic/hack-5.10/600-bridge_offload.patch index 586353816c..7e1b852bf3 100644 --- a/target/linux/generic/hack-5.10/600-bridge_offload.patch +++ b/target/linux/generic/hack-5.10/600-bridge_offload.patch @@ -434,13 +434,13 @@ + vg = nbp_vlan_group_rcu(inp); + vlan = cb->input_vlan_present ? cb->input_vlan_tag : br_get_pvid(vg); + fdb_in = br_fdb_find_rcu(p->br, eth_hdr(skb)->h_source, vlan); -+ if (!fdb_in) ++ if (!fdb_in || !fdb_in->dst) + goto out; + + vg = nbp_vlan_group_rcu(p); + vlan = skb_vlan_tag_present(skb) ? skb_vlan_tag_get_id(skb) : br_get_pvid(vg); + fdb_out = br_fdb_find_rcu(p->br, eth_hdr(skb)->h_dest, vlan); -+ if (!fdb_out) ++ if (!fdb_out || !fdb_out->dst) + goto out; + + br_offload_prepare_key(p, &key, skb); @@ -450,7 +450,7 @@ +#endif + + flow = kmem_cache_alloc(offload_cache, GFP_ATOMIC); -+ flow->port = fdb_in->dst; ++ flow->port = inp; + memcpy(&flow->key, &key, sizeof(key)); + +#ifdef CONFIG_BRIDGE_VLAN_FILTERING @@ -465,7 +465,7 @@ + spin_lock_bh(&offload_lock); + if (!o->enabled || + atomic_read(&p->offload.rht.nelems) >= p->br->offload_cache_size || -+ rhashtable_insert_fast(&flow->port->offload.rht, &flow->node, flow_params)) { ++ rhashtable_insert_fast(&inp->offload.rht, &flow->node, flow_params)) { + kmem_cache_free(offload_cache, flow); + goto out_unlock; + } @@ -511,8 +511,8 @@ +#ifdef CONFIG_BRIDGE_VLAN_FILTERING + cb->input_vlan_present = key.vlan_present != 0; + cb->input_vlan_tag = key.vlan_tag; -+ cb->input_ifindex = p->dev->ifindex; +#endif ++ cb->input_ifindex = p->dev->ifindex; + goto out; + } + |