Commit bd51350f authored by Nikolay Aleksandrov's avatar Nikolay Aleksandrov Committed by Jialin Zhang
Browse files

net: bridge: mcast: add and enforce query interval minimum 

mainline inclusion
from mainline-v5.16-rc8
commit 99b40610
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6DKZJ
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=99b40610956a8a8755653a67392e2a8b772453be

--------------------------------

As reported[1] if query interval is set too low and we have multiple
bridges or even a single bridge with multiple querier vlans configured
we can crash the machine. Add a 1 second minimum which must be enforced
by overwriting the value if set lower (i.e. without returning an error) to
avoid breaking user-space. If that happens a log message is emitted to let
the administrator know that the interval has been set to the minimum.
The issue has been present since these intervals could be user-controlled.

[1] https://lore.kernel.org/netdev/e8b9ce41-57b9-b6e2-a46a-ff9c791cf0ba@gmail.com/



Fixes: d902eee4 ("bridge: Add multicast count/interval sysfs entries")
Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>

Conflicts:
	net/bridge/br_multicast.c
	net/bridge/br_netlink.c
	net/bridge/br_private.h
	net/bridge/br_sysfs_br.c

Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent f5014d90

net/bridge/br_multicast.c

+16 −0
Original line number Diff line number Diff line
@@ -3625,6 +3625,22 @@ void br_multicast_set_startup_query_intvl(struct net_bridge *br, 
	br->multicast_startup_query_interval = intvl_jiffies;

}



void br_multicast_set_query_intvl(struct net_bridge *br,

				  unsigned long val)

{

	unsigned long intvl_jiffies = clock_t_to_jiffies(val);



	if (intvl_jiffies < BR_MULTICAST_QUERY_INTVL_MIN) {

		br_info(br,

			"trying to set multicast query interval below minimum, setting to %lu (%ums)\n",

			jiffies_to_clock_t(BR_MULTICAST_QUERY_INTVL_MIN),

			jiffies_to_msecs(BR_MULTICAST_QUERY_INTVL_MIN));

		intvl_jiffies = BR_MULTICAST_QUERY_INTVL_MIN;

	}



	br->multicast_query_interval = intvl_jiffies;

}



/**

 * br_multicast_list_adjacent - Returns snooped multicast addresses

 * @dev:	The bridge port adjacent to which to retrieve addresses

net/bridge/br_netlink.c

+1 −1
Original line number Diff line number Diff line
@@ -1286,7 +1286,7 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[], 
	if (data[IFLA_BR_MCAST_QUERY_INTVL]) {

		u64 val = nla_get_u64(data[IFLA_BR_MCAST_QUERY_INTVL]);



		br->multicast_query_interval = clock_t_to_jiffies(val);

		br_multicast_set_query_intvl(br, val);

	}



	if (data[IFLA_BR_MCAST_QUERY_RESPONSE_INTVL]) {

net/bridge/br_private.h

+2 −0
Original line number Diff line number Diff line
@@ -1572,4 +1572,6 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, 
struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *m);

void br_multicast_set_startup_query_intvl(struct net_bridge *br,

					  unsigned long val);

void br_multicast_set_query_intvl(struct net_bridge *br,

				  unsigned long val);

#endif

net/bridge/br_sysfs_br.c

+1 −1
Original line number Diff line number Diff line
@@ -594,7 +594,7 @@ static ssize_t multicast_query_interval_show(struct device *d, 


static int set_query_interval(struct net_bridge *br, unsigned long val)

{

	br->multicast_query_interval = clock_t_to_jiffies(val);

	br_multicast_set_query_intvl(br, val);

	return 0;

}