• Nikolay Aleksandrov's avatar
    net: bridge: fix old ioctl unlocked net device walk · 2b3e8cb1
    Nikolay Aleksandrov authored
    commit 31ca0458 upstream.
    
    get_bridge_ifindices() is used from the old "deviceless" bridge ioctl
    calls which aren't called with rtnl held. The comment above says that it is
    called with rtnl but that is not really the case.
    Here's a sample output from a test ASSERT_RTNL() which I put in
    get_bridge_ifindices and executed "brctl show":
    [  957.422726] RTNL: assertion failed at net/bridge//br_ioctl.c (30)
    [  957.422925] CPU: 0 PID: 1862 Comm: brctl Tainted: G        W  O
    4.6.0-rc4+ #157
    [  957.423009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
    BIOS 1.8.1-20150318_183358- 04/01/2014
    [  957.423009]  0000000000000000 ffff880058adfdf0 ffffffff8138dec5
    0000000000000400
    [  957.423009]  ffffffff81ce8380 ffff880058adfe58 ffffffffa05ead32
    0000000000000001
    [  957.423009]  00007ffec1a444b0 0000000000000400 ffff880053c19130
    0000000000008940
    [  957.423009] Call Trace:
    [  957.423009]  [<ffffffff8138dec5>] dump_stack+0x85/0xc0
    [  957.423009]  [<ffffffffa05ead32>]
    br_ioctl_deviceless_stub+0x212/0x2e0 [bridge]
    [  957.423009]  [<ffffffff81515beb>] sock_ioctl+0x22b/0x290
    [  957.423009]  [<ffffffff8126ba75>] do_vfs_ioctl+0x95/0x700
    [  957.423009]  [<ffffffff8126c159>] SyS_ioctl+0x79/0x90
    [  957.423009]  [<ffffffff8163a4c0>] entry_SYSCALL_64_fastpath+0x23/0xc1
    
    Since it only reads bridge ifindices, we can use rcu to safely walk the net
    device list. Also remove the wrong rtnl comment above.
    Signed-off-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
    2b3e8cb1
br_ioctl.c 8.9 KB