Unverified Commit 0c439cd2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10287 CVE-2024-36979 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yuan Can <yuancan@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QMKCL3PV5DZRSR7KNUYISUDEW54NU7RW/ 
Nikolay Aleksandrov (3):
  net: bridge: mst: fix vlan use-after-free
  net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
  net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state


-- 
2.17.1
 
https://gitee.com/src-openeuler/kernel/issues/IA6S78 
 
Link:https://gitee.com/openeuler/kernel/pulls/10287

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents b3a5ef8d ecfc5638

net/bridge/br_mst.c

+16 −13
Original line number Diff line number Diff line
@@ -73,12 +73,11 @@ int br_mst_get_state(const struct net_device *dev, u16 msti, u8 *state) 
}

EXPORT_SYMBOL_GPL(br_mst_get_state);



static void br_mst_vlan_set_state(struct net_bridge_port *p, struct net_bridge_vlan *v,

static void br_mst_vlan_set_state(struct net_bridge_vlan_group *vg,

				  struct net_bridge_vlan *v,

				  u8 state)

{

	struct net_bridge_vlan_group *vg = nbp_vlan_group(p);



	if (v->state == state)

	if (br_vlan_get_state(v) == state)

		return;



	br_vlan_set_state(v, state);
@@ -100,11 +99,12 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, 
	};

	struct net_bridge_vlan_group *vg;

	struct net_bridge_vlan *v;

	int err;

	int err = 0;



	vg = nbp_vlan_group(p);

	rcu_read_lock();

	vg = nbp_vlan_group_rcu(p);

	if (!vg)

		return 0;

		goto out;



	/* MSTI 0 (CST) state changes are notified via the regular

	 * SWITCHDEV_ATTR_ID_PORT_STP_STATE.
@@ -112,17 +112,20 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, 
	if (msti) {

		err = switchdev_port_attr_set(p->dev, &attr, extack);

		if (err && err != -EOPNOTSUPP)

			return err;

			goto out;

	}



	list_for_each_entry(v, &vg->vlan_list, vlist) {

	err = 0;

	list_for_each_entry_rcu(v, &vg->vlan_list, vlist) {

		if (v->brvlan->msti != msti)

			continue;



		br_mst_vlan_set_state(p, v, state);

		br_mst_vlan_set_state(vg, v, state);

	}



	return 0;

out:

	rcu_read_unlock();

	return err;

}



static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti)
@@ -136,13 +139,13 @@ static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti) 
		 * it.

		 */

		if (v != pv && v->brvlan->msti == msti) {

			br_mst_vlan_set_state(pv->port, pv, v->state);

			br_mst_vlan_set_state(vg, pv, v->state);

			return;

		}

	}



	/* Otherwise, start out in a new MSTI with all ports disabled. */

	return br_mst_vlan_set_state(pv->port, pv, BR_STATE_DISABLED);

	return br_mst_vlan_set_state(vg, pv, BR_STATE_DISABLED);

}



int br_mst_vlan_set_msti(struct net_bridge_vlan *mv, u16 msti)