public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

net: bridge: fix ioctl locking

Browse source 
Before commit ad2f99aedf ("net: bridge: move bridge ioctls out of
.ndo_do_ioctl") the bridge ioctl calls were divided in two parts:
one was deviceless called by sock_ioctl and didn't expect rtnl to be held,
the other was with a device called by dev_ifsioc() and expected rtnl to be
held. After the commit above they were united in a single ioctl stub, but
it didn't take care of the locking expectations.
For sock_ioctl now we acquire  (1) br_ioctl_mutex, (2) rtnl
and for dev_ifsioc we acquire  (1) rtnl,           (2) br_ioctl_mutex

The fix is to get a refcnt on the netdev for dev_ifsioc calls and drop rtnl
then to reacquire it in the bridge ioctl stub after br_ioctl_mutex has
been acquired. That will avoid playing locking games and make the rules
straight-forward: we always take br_ioctl_mutex first, and then rtnl.

Reported-by: syzbot+34fe5894623c4ab1b379@syzkaller.appspotmail.com
Fixes: ad2f99aedf ("net: bridge: move bridge ioctls out of .ndo_do_ioctl")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Nikolay Aleksandrov 2021-08-05 11:29:01 +03:00 • committed by David S. Miller
parent 4167a96057
commit 893b195875
3 changed files with 31 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
net/bridge/br_if.c
View file

@ -456,7 +456,7 @@ int br_add_bridge(struct net *net, const char *name)
dev_net_set(dev, net); dev_net_set(dev, net);
dev->rtnl_link_ops = &br_link_ops; dev->rtnl_link_ops = &br_link_ops;
res = register_netdev(dev); res = register_netdevice(dev);
if (res) if (res)
free_netdev(dev); free_netdev(dev);
return res; return res;
@ -467,7 +467,6 @@ int br_del_bridge(struct net *net, const char *name)
struct net_device *dev; struct net_device *dev;
int ret = 0; int ret = 0;
rtnl_lock();
dev = __dev_get_by_name(net, name); dev = __dev_get_by_name(net, name);
if (dev == NULL) if (dev == NULL)
ret = -ENXIO; /* Could not find device */ ret = -ENXIO; /* Could not find device */
@ -485,7 +484,6 @@ int br_del_bridge(struct net *net, const char *name)
else else
br_dev_delete(dev, NULL); br_dev_delete(dev, NULL);
rtnl_unlock();
return ret; return ret;
} }

37
net/bridge/br_ioctl.c
View file

@ -369,33 +369,44 @@ static int old_deviceless(struct net *net, void __user *uarg)
int br_ioctl_stub(struct net *net, struct net_bridge *br, unsigned int cmd, int br_ioctl_stub(struct net *net, struct net_bridge *br, unsigned int cmd,
struct ifreq *ifr, void __user *uarg) struct ifreq *ifr, void __user *uarg)
{ {
int ret = -EOPNOTSUPP;
rtnl_lock();
switch (cmd) { switch (cmd) {
case SIOCGIFBR: case SIOCGIFBR:
case SIOCSIFBR: case SIOCSIFBR:
return old_deviceless(net, uarg); ret = old_deviceless(net, uarg);
break;
case SIOCBRADDBR: case SIOCBRADDBR:
case SIOCBRDELBR: case SIOCBRDELBR:
{ {
char buf[IFNAMSIZ]; char buf[IFNAMSIZ];
if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
return -EPERM; ret = -EPERM;
break;
}
if (copy_from_user(buf, uarg, IFNAMSIZ)) if (copy_from_user(buf, uarg, IFNAMSIZ)) {
return -EFAULT; ret = -EFAULT;
break;
}
buf[IFNAMSIZ-1] = 0; buf[IFNAMSIZ-1] = 0;
if (cmd == SIOCBRADDBR) if (cmd == SIOCBRADDBR)
return br_add_bridge(net, buf); ret = br_add_bridge(net, buf);
else
return br_del_bridge(net, buf); ret = br_del_bridge(net, buf);
} }
break;
case SIOCBRADDIF: case SIOCBRADDIF:
case SIOCBRDELIF: case SIOCBRDELIF:
return add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF); ret = add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF);
break;
} }
return -EOPNOTSUPP;
rtnl_unlock();
return ret;
} }

7
net/core/dev_ioctl.c
View file

@ -379,7 +379,12 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data,
case SIOCBRDELIF: case SIOCBRDELIF:
if (!netif_device_present(dev)) if (!netif_device_present(dev))
return -ENODEV; return -ENODEV;
return br_ioctl_call(net, netdev_priv(dev), cmd, ifr, NULL); dev_hold(dev);
rtnl_unlock();
err = br_ioctl_call(net, netdev_priv(dev), cmd, ifr, NULL);
dev_put(dev);
rtnl_lock();
return err;
case SIOCSHWTSTAMP: case SIOCSHWTSTAMP:
err = net_hwtstamp_validate(ifr); err = net_hwtstamp_validate(ifr);