Commit 468e7944 authored by Nikolay Aleksandrov's avatar Nikolay Aleksandrov Committed by David S. Miller

bridge: vlan: fix possible null vlgrp deref while registering new port

While a new port is being initialized the rx_handler gets set, but the
vlans get initialized later in br_add_if() and in that window if we
receive a frame with a link-local address we can try to dereference
p->vlgrp in:
br_handle_frame() -> br_handle_local_finish() -> br_should_learn()

Fix this by checking vlgrp before using it.
Signed-off-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8af78b64
...@@ -476,13 +476,15 @@ bool br_allowed_egress(struct net_bridge_vlan_group *vg, ...@@ -476,13 +476,15 @@ bool br_allowed_egress(struct net_bridge_vlan_group *vg,
/* Called under RCU */ /* Called under RCU */
bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid) bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
{ {
struct net_bridge_vlan_group *vg;
struct net_bridge *br = p->br; struct net_bridge *br = p->br;
/* If filtering was disabled at input, let it pass. */ /* If filtering was disabled at input, let it pass. */
if (!br->vlan_enabled) if (!br->vlan_enabled)
return true; return true;
if (!p->vlgrp->num_vlans) vg = p->vlgrp;
if (!vg || !vg->num_vlans)
return false; return false;
if (!br_vlan_get_tag(skb, vid) && skb->vlan_proto != br->vlan_proto) if (!br_vlan_get_tag(skb, vid) && skb->vlan_proto != br->vlan_proto)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment