Skip to content

Commit 09f4337

Browse files
NikAleksandrovgregkh
authored andcommitted
net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
[ Upstream commit 36c9293 ] Pass the already obtained vlan group pointer to br_mst_vlan_set_state() instead of dereferencing it again. Each caller has already correctly dereferenced it for their context. This change is required for the following suspicious RCU dereference fix. No functional changes intended. Fixes: 3a7c166 ("net: bridge: mst: fix vlan use-after-free") Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=9bbe2de1bc9d470eb5fe Signed-off-by: Nikolay Aleksandrov <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
1 parent cd68f84 commit 09f4337

File tree

1 file changed

+5
-6
lines changed

1 file changed

+5
-6
lines changed

net/bridge/br_mst.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,10 @@ int br_mst_get_state(const struct net_device *dev, u16 msti, u8 *state)
7373
}
7474
EXPORT_SYMBOL_GPL(br_mst_get_state);
7575

76-
static void br_mst_vlan_set_state(struct net_bridge_port *p, struct net_bridge_vlan *v,
76+
static void br_mst_vlan_set_state(struct net_bridge_vlan_group *vg,
77+
struct net_bridge_vlan *v,
7778
u8 state)
7879
{
79-
struct net_bridge_vlan_group *vg = nbp_vlan_group(p);
80-
8180
if (br_vlan_get_state(v) == state)
8281
return;
8382

@@ -121,7 +120,7 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state,
121120
if (v->brvlan->msti != msti)
122121
continue;
123122

124-
br_mst_vlan_set_state(p, v, state);
123+
br_mst_vlan_set_state(vg, v, state);
125124
}
126125

127126
out:
@@ -140,13 +139,13 @@ static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti)
140139
* it.
141140
*/
142141
if (v != pv && v->brvlan->msti == msti) {
143-
br_mst_vlan_set_state(pv->port, pv, v->state);
142+
br_mst_vlan_set_state(vg, pv, v->state);
144143
return;
145144
}
146145
}
147146

148147
/* Otherwise, start out in a new MSTI with all ports disabled. */
149-
return br_mst_vlan_set_state(pv->port, pv, BR_STATE_DISABLED);
148+
return br_mst_vlan_set_state(vg, pv, BR_STATE_DISABLED);
150149
}
151150

152151
int br_mst_vlan_set_msti(struct net_bridge_vlan *mv, u16 msti)

0 commit comments

Comments
 (0)