bridge: fix rcu dereference outside of rcu_read_lock
authorStephen Hemminger <shemminger@vyatta.com>
Tue, 14 Aug 2012 15:19:33 +0000 (08:19 -0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 15 Aug 2012 22:09:41 +0000 (15:09 -0700)
commitc03307eab68d583ea6db917681afa14ed1fb3b84
treed2480b2fd892254e7a37b5b757be6f2c40c2ca6b
parent7bab3ae7608292fd987e390dec9fc21fd6dc4d7d
bridge: fix rcu dereference outside of rcu_read_lock

Alternative solution for problem found by Linux Driver Verification
project (linuxtesting.org).

As it noted in the comment before the br_handle_frame_finish
function, this function should be called under rcu_read_lock.

The problem callgraph:
br_dev_xmit -> br_nf_pre_routing_finish_bridge_slow ->
 -> br_handle_frame_finish -> br_port_get_rcu -> rcu_dereference

And in this case there is no read-lock section.

Reported-by: Denis Efremov <yefremov.denis@gmail.com>
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bridge/br_device.c