ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-19 21:58:04 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

kernel: fix crashes in bridge offload code

Browse Source 
- fix an issues when accessing the port pointer of an expired/invalid fdb entry

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2022-05-31 14:01:21 +02:00
parent b21b98627d
commit 38a5b593ef
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
target/linux/generic/hack-5.10/600-bridge_offload.patch
View File

@ -434,13 +434,13 @@
+ vg = nbp_vlan_group_rcu(inp);
+ vlan = cb->input_vlan_present ? cb->input_vlan_tag : br_get_pvid(vg);
+ fdb_in = br_fdb_find_rcu(p->br, eth_hdr(skb)->h_source, vlan);
+ if (!fdb_in)
+ if (!fdb_in || !fdb_in->dst)
+ goto out;
+
+ vg = nbp_vlan_group_rcu(p);
+ vlan = skb_vlan_tag_present(skb) ? skb_vlan_tag_get_id(skb) : br_get_pvid(vg);
+ fdb_out = br_fdb_find_rcu(p->br, eth_hdr(skb)->h_dest, vlan);
+ if (!fdb_out)
+ if (!fdb_out || !fdb_out->dst)
+ goto out;
+
+ br_offload_prepare_key(p, &key, skb);
@ -450,7 +450,7 @@
+#endif
+
+ flow = kmem_cache_alloc(offload_cache, GFP_ATOMIC);
+ flow->port = fdb_in->dst;
+ flow->port = inp;
+ memcpy(&flow->key, &key, sizeof(key));
+
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
@ -465,7 +465,7 @@
+ spin_lock_bh(&offload_lock);
+ if (!o->enabled ||
+ atomic_read(&p->offload.rht.nelems) >= p->br->offload_cache_size ||
+ rhashtable_insert_fast(&flow->port->offload.rht, &flow->node, flow_params)) {
+ rhashtable_insert_fast(&inp->offload.rht, &flow->node, flow_params)) {
+ kmem_cache_free(offload_cache, flow);
+ goto out_unlock;
+ }
@ -511,8 +511,8 @@
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
+ cb->input_vlan_present = key.vlan_present != 0;
+ cb->input_vlan_tag = key.vlan_tag;
+ cb->input_ifindex = p->dev->ifindex;
+#endif
+ cb->input_ifindex = p->dev->ifindex;
+ goto out;
+ }
+

10
target/linux/generic/hack-5.15/600-bridge_offload.patch
View File

@ -434,13 +434,13 @@
+ vg = nbp_vlan_group_rcu(inp);
+ vlan = cb->input_vlan_present ? cb->input_vlan_tag : br_get_pvid(vg);
+ fdb_in = br_fdb_find_rcu(p->br, eth_hdr(skb)->h_source, vlan);
+ if (!fdb_in)
+ if (!fdb_in || !fdb_in->dst)
+ goto out;
+
+ vg = nbp_vlan_group_rcu(p);
+ vlan = skb_vlan_tag_present(skb) ? skb_vlan_tag_get_id(skb) : br_get_pvid(vg);
+ fdb_out = br_fdb_find_rcu(p->br, eth_hdr(skb)->h_dest, vlan);
+ if (!fdb_out)
+ if (!fdb_out || !fdb_out->dst)
+ goto out;
+
+ br_offload_prepare_key(p, &key, skb);
@ -450,7 +450,7 @@
+#endif
+
+ flow = kmem_cache_alloc(offload_cache, GFP_ATOMIC);
+ flow->port = fdb_in->dst;
+ flow->port = inp;
+ memcpy(&flow->key, &key, sizeof(key));
+
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
@ -465,7 +465,7 @@
+ spin_lock_bh(&offload_lock);
+ if (!o->enabled ||
+ atomic_read(&p->offload.rht.nelems) >= p->br->offload_cache_size ||
+ rhashtable_insert_fast(&flow->port->offload.rht, &flow->node, flow_params)) {
+ rhashtable_insert_fast(&inp->offload.rht, &flow->node, flow_params)) {
+ kmem_cache_free(offload_cache, flow);
+ goto out_unlock;
+ }
@ -511,8 +511,8 @@
+#ifdef CONFIG_BRIDGE_VLAN_FILTERING
+ cb->input_vlan_present = key.vlan_present != 0;
+ cb->input_vlan_tag = key.vlan_tag;
+ cb->input_ifindex = p->dev->ifindex;
+#endif
+ cb->input_ifindex = p->dev->ifindex;
+ goto out;
+ }
+