Commit 5aa28201 authored by Sebastian Andrzej Siewior's avatar Sebastian Andrzej Siewior Committed by Jakub Kicinski
Browse files

hsr: Add a rcu-read lock to hsr_forward_skb(). 



hsr_forward_skb() a skb and keeps information in an on-stack
hsr_frame_info. hsr_get_node() assigns hsr_frame_info::node_src which is
from a RCU list. This pointer is used later in hsr_forward_do().
I don't see a reason why this pointer can't vanish midway since there is
no guarantee that hsr_forward_skb() is invoked from an RCU read section.

Use rcu_read_lock() to protect hsr_frame_info::node_src from its
assignment until it is no longer used.

Fixes: f266a683 ("net/hsr: Better frame dispatch")
Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent e012764c

net/hsr/hsr_forward.c

+3 −0
Original line number Diff line number Diff line
@@ -614,11 +614,13 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port *port) 
{

	struct hsr_frame_info frame;



	rcu_read_lock();

	if (fill_frame_info(&frame, skb, port) < 0)

		goto out_drop;



	hsr_register_frame_in(frame.node_src, port, frame.sequence_nr);

	hsr_forward_do(&frame);

	rcu_read_unlock();

	/* Gets called for ingress frames as well as egress from master port.

	 * So check and increment stats for master port only here.

	 */
@@ -633,6 +635,7 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port *port) 
	return;



out_drop:

	rcu_read_unlock();

	port->dev->stats.tx_dropped++;

	kfree_skb(skb);

}