mirror of
				git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
				synced 2025-10-31 08:44:41 +00:00 
			
		
		
		
	 573201f36f
			
		
	
	
		573201f36f
		
	
	
	
	
		
			
			The new netpoll code in bridging contains use-after-free bugs that are non-trivial to fix. This patch fixes this by removing the code that uses skbs after they're freed. As a consequence, this means that we can no longer call bridge from the netpoll path, so this patch also removes the controller function in order to disable netpoll. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Thanks, Signed-off-by: David S. Miller <davem@davemloft.net>
		
			
				
	
	
		
			315 lines
		
	
	
	
		
			7.3 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			315 lines
		
	
	
	
		
			7.3 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  *	Device handling code
 | |
|  *	Linux ethernet bridge
 | |
|  *
 | |
|  *	Authors:
 | |
|  *	Lennert Buytenhek		<buytenh@gnu.org>
 | |
|  *
 | |
|  *	This program is free software; you can redistribute it and/or
 | |
|  *	modify it under the terms of the GNU General Public License
 | |
|  *	as published by the Free Software Foundation; either version
 | |
|  *	2 of the License, or (at your option) any later version.
 | |
|  */
 | |
| 
 | |
| #include <linux/kernel.h>
 | |
| #include <linux/netdevice.h>
 | |
| #include <linux/netpoll.h>
 | |
| #include <linux/etherdevice.h>
 | |
| #include <linux/ethtool.h>
 | |
| #include <linux/list.h>
 | |
| #include <linux/netfilter_bridge.h>
 | |
| 
 | |
| #include <asm/uaccess.h>
 | |
| #include "br_private.h"
 | |
| 
 | |
| /* net device transmit always called with no BH (preempt_disabled) */
 | |
| netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 	const unsigned char *dest = skb->data;
 | |
| 	struct net_bridge_fdb_entry *dst;
 | |
| 	struct net_bridge_mdb_entry *mdst;
 | |
| 	struct br_cpu_netstats *brstats = this_cpu_ptr(br->stats);
 | |
| 
 | |
| #ifdef CONFIG_BRIDGE_NETFILTER
 | |
| 	if (skb->nf_bridge && (skb->nf_bridge->mask & BRNF_BRIDGED_DNAT)) {
 | |
| 		br_nf_pre_routing_finish_bridge_slow(skb);
 | |
| 		return NETDEV_TX_OK;
 | |
| 	}
 | |
| #endif
 | |
| 
 | |
| 	brstats->tx_packets++;
 | |
| 	brstats->tx_bytes += skb->len;
 | |
| 
 | |
| 	BR_INPUT_SKB_CB(skb)->brdev = dev;
 | |
| 
 | |
| 	skb_reset_mac_header(skb);
 | |
| 	skb_pull(skb, ETH_HLEN);
 | |
| 
 | |
| 	if (is_multicast_ether_addr(dest)) {
 | |
| 		if (br_multicast_rcv(br, NULL, skb))
 | |
| 			goto out;
 | |
| 
 | |
| 		mdst = br_mdb_get(br, skb);
 | |
| 		if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
 | |
| 			br_multicast_deliver(mdst, skb);
 | |
| 		else
 | |
| 			br_flood_deliver(br, skb);
 | |
| 	} else if ((dst = __br_fdb_get(br, dest)) != NULL)
 | |
| 		br_deliver(dst->dst, skb);
 | |
| 	else
 | |
| 		br_flood_deliver(br, skb);
 | |
| 
 | |
| out:
 | |
| 	return NETDEV_TX_OK;
 | |
| }
 | |
| 
 | |
| static int br_dev_open(struct net_device *dev)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 
 | |
| 	br_features_recompute(br);
 | |
| 	netif_start_queue(dev);
 | |
| 	br_stp_enable_bridge(br);
 | |
| 	br_multicast_open(br);
 | |
| 
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| static void br_dev_set_multicast_list(struct net_device *dev)
 | |
| {
 | |
| }
 | |
| 
 | |
| static int br_dev_stop(struct net_device *dev)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 
 | |
| 	br_stp_disable_bridge(br);
 | |
| 	br_multicast_stop(br);
 | |
| 
 | |
| 	netif_stop_queue(dev);
 | |
| 
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| static struct net_device_stats *br_get_stats(struct net_device *dev)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 	struct net_device_stats *stats = &dev->stats;
 | |
| 	struct br_cpu_netstats sum = { 0 };
 | |
| 	unsigned int cpu;
 | |
| 
 | |
| 	for_each_possible_cpu(cpu) {
 | |
| 		const struct br_cpu_netstats *bstats
 | |
| 			= per_cpu_ptr(br->stats, cpu);
 | |
| 
 | |
| 		sum.tx_bytes   += bstats->tx_bytes;
 | |
| 		sum.tx_packets += bstats->tx_packets;
 | |
| 		sum.rx_bytes   += bstats->rx_bytes;
 | |
| 		sum.rx_packets += bstats->rx_packets;
 | |
| 	}
 | |
| 
 | |
| 	stats->tx_bytes   = sum.tx_bytes;
 | |
| 	stats->tx_packets = sum.tx_packets;
 | |
| 	stats->rx_bytes   = sum.rx_bytes;
 | |
| 	stats->rx_packets = sum.rx_packets;
 | |
| 
 | |
| 	return stats;
 | |
| }
 | |
| 
 | |
| static int br_change_mtu(struct net_device *dev, int new_mtu)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 	if (new_mtu < 68 || new_mtu > br_min_mtu(br))
 | |
| 		return -EINVAL;
 | |
| 
 | |
| 	dev->mtu = new_mtu;
 | |
| 
 | |
| #ifdef CONFIG_BRIDGE_NETFILTER
 | |
| 	/* remember the MTU in the rtable for PMTU */
 | |
| 	br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
 | |
| #endif
 | |
| 
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| /* Allow setting mac address to any valid ethernet address. */
 | |
| static int br_set_mac_address(struct net_device *dev, void *p)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 	struct sockaddr *addr = p;
 | |
| 
 | |
| 	if (!is_valid_ether_addr(addr->sa_data))
 | |
| 		return -EINVAL;
 | |
| 
 | |
| 	spin_lock_bh(&br->lock);
 | |
| 	memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
 | |
| 	br_stp_change_bridge_id(br, addr->sa_data);
 | |
| 	br->flags |= BR_SET_MAC_ADDR;
 | |
| 	spin_unlock_bh(&br->lock);
 | |
| 
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| static void br_getinfo(struct net_device *dev, struct ethtool_drvinfo *info)
 | |
| {
 | |
| 	strcpy(info->driver, "bridge");
 | |
| 	strcpy(info->version, BR_VERSION);
 | |
| 	strcpy(info->fw_version, "N/A");
 | |
| 	strcpy(info->bus_info, "N/A");
 | |
| }
 | |
| 
 | |
| static int br_set_sg(struct net_device *dev, u32 data)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 
 | |
| 	if (data)
 | |
| 		br->feature_mask |= NETIF_F_SG;
 | |
| 	else
 | |
| 		br->feature_mask &= ~NETIF_F_SG;
 | |
| 
 | |
| 	br_features_recompute(br);
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| static int br_set_tso(struct net_device *dev, u32 data)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 
 | |
| 	if (data)
 | |
| 		br->feature_mask |= NETIF_F_TSO;
 | |
| 	else
 | |
| 		br->feature_mask &= ~NETIF_F_TSO;
 | |
| 
 | |
| 	br_features_recompute(br);
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| static int br_set_tx_csum(struct net_device *dev, u32 data)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 
 | |
| 	if (data)
 | |
| 		br->feature_mask |= NETIF_F_NO_CSUM;
 | |
| 	else
 | |
| 		br->feature_mask &= ~NETIF_F_ALL_CSUM;
 | |
| 
 | |
| 	br_features_recompute(br);
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| #ifdef CONFIG_NET_POLL_CONTROLLER
 | |
| static bool br_devices_support_netpoll(struct net_bridge *br)
 | |
| {
 | |
| 	struct net_bridge_port *p;
 | |
| 	bool ret = true;
 | |
| 	int count = 0;
 | |
| 	unsigned long flags;
 | |
| 
 | |
| 	spin_lock_irqsave(&br->lock, flags);
 | |
| 	list_for_each_entry(p, &br->port_list, list) {
 | |
| 		count++;
 | |
| 		if ((p->dev->priv_flags & IFF_DISABLE_NETPOLL) ||
 | |
| 		    !p->dev->netdev_ops->ndo_poll_controller)
 | |
| 			ret = false;
 | |
| 	}
 | |
| 	spin_unlock_irqrestore(&br->lock, flags);
 | |
| 	return count != 0 && ret;
 | |
| }
 | |
| 
 | |
| void br_netpoll_cleanup(struct net_device *dev)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 	struct net_bridge_port *p, *n;
 | |
| 	const struct net_device_ops *ops;
 | |
| 
 | |
| 	br->dev->npinfo = NULL;
 | |
| 	list_for_each_entry_safe(p, n, &br->port_list, list) {
 | |
| 		if (p->dev) {
 | |
| 			ops = p->dev->netdev_ops;
 | |
| 			if (ops->ndo_netpoll_cleanup)
 | |
| 				ops->ndo_netpoll_cleanup(p->dev);
 | |
| 			else
 | |
| 				p->dev->npinfo = NULL;
 | |
| 		}
 | |
| 	}
 | |
| }
 | |
| 
 | |
| void br_netpoll_disable(struct net_bridge *br,
 | |
| 			struct net_device *dev)
 | |
| {
 | |
| 	if (br_devices_support_netpoll(br))
 | |
| 		br->dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
 | |
| 	if (dev->netdev_ops->ndo_netpoll_cleanup)
 | |
| 		dev->netdev_ops->ndo_netpoll_cleanup(dev);
 | |
| 	else
 | |
| 		dev->npinfo = NULL;
 | |
| }
 | |
| 
 | |
| void br_netpoll_enable(struct net_bridge *br,
 | |
| 		       struct net_device *dev)
 | |
| {
 | |
| 	if (br_devices_support_netpoll(br)) {
 | |
| 		br->dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
 | |
| 		if (br->dev->npinfo)
 | |
| 			dev->npinfo = br->dev->npinfo;
 | |
| 	} else if (!(br->dev->priv_flags & IFF_DISABLE_NETPOLL)) {
 | |
| 		br->dev->priv_flags |= IFF_DISABLE_NETPOLL;
 | |
| 		br_info(br,"new device %s does not support netpoll (disabling)",
 | |
| 			dev->name);
 | |
| 	}
 | |
| }
 | |
| 
 | |
| #endif
 | |
| 
 | |
| static const struct ethtool_ops br_ethtool_ops = {
 | |
| 	.get_drvinfo    = br_getinfo,
 | |
| 	.get_link	= ethtool_op_get_link,
 | |
| 	.get_tx_csum	= ethtool_op_get_tx_csum,
 | |
| 	.set_tx_csum 	= br_set_tx_csum,
 | |
| 	.get_sg		= ethtool_op_get_sg,
 | |
| 	.set_sg		= br_set_sg,
 | |
| 	.get_tso	= ethtool_op_get_tso,
 | |
| 	.set_tso	= br_set_tso,
 | |
| 	.get_ufo	= ethtool_op_get_ufo,
 | |
| 	.set_ufo	= ethtool_op_set_ufo,
 | |
| 	.get_flags	= ethtool_op_get_flags,
 | |
| };
 | |
| 
 | |
| static const struct net_device_ops br_netdev_ops = {
 | |
| 	.ndo_open		 = br_dev_open,
 | |
| 	.ndo_stop		 = br_dev_stop,
 | |
| 	.ndo_start_xmit		 = br_dev_xmit,
 | |
| 	.ndo_get_stats		 = br_get_stats,
 | |
| 	.ndo_set_mac_address	 = br_set_mac_address,
 | |
| 	.ndo_set_multicast_list	 = br_dev_set_multicast_list,
 | |
| 	.ndo_change_mtu		 = br_change_mtu,
 | |
| 	.ndo_do_ioctl		 = br_dev_ioctl,
 | |
| #ifdef CONFIG_NET_POLL_CONTROLLER
 | |
| 	.ndo_netpoll_cleanup	 = br_netpoll_cleanup,
 | |
| #endif
 | |
| };
 | |
| 
 | |
| static void br_dev_free(struct net_device *dev)
 | |
| {
 | |
| 	struct net_bridge *br = netdev_priv(dev);
 | |
| 
 | |
| 	free_percpu(br->stats);
 | |
| 	free_netdev(dev);
 | |
| }
 | |
| 
 | |
| void br_dev_setup(struct net_device *dev)
 | |
| {
 | |
| 	random_ether_addr(dev->dev_addr);
 | |
| 	ether_setup(dev);
 | |
| 
 | |
| 	dev->netdev_ops = &br_netdev_ops;
 | |
| 	dev->destructor = br_dev_free;
 | |
| 	SET_ETHTOOL_OPS(dev, &br_ethtool_ops);
 | |
| 	dev->tx_queue_len = 0;
 | |
| 	dev->priv_flags = IFF_EBRIDGE;
 | |
| 
 | |
| 	dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
 | |
| 			NETIF_F_GSO_MASK | NETIF_F_NO_CSUM | NETIF_F_LLTX |
 | |
| 			NETIF_F_NETNS_LOCAL | NETIF_F_GSO;
 | |
| }
 |