| Message ID | 20210610120411.128339-1-razor@blackwall.org (mailing list archive) |
|---|---|
| Headers | show |
| Series | net: bridge: vlan tunnel egress path fixes | expand |
Hello: This series was applied to netdev/net.git (refs/heads/master): On Thu, 10 Jun 2021 15:04:09 +0300 you wrote: > From: Nikolay Aleksandrov <nikolay@nvidia.com> > > Hi, > These two fixes take care of tunnel_dst problems in the vlan tunnel egress > path. Patch 01 fixes a null ptr deref due to the lockless use of tunnel_dst > pointer without checking it first, and patch 02 fixes a use-after-free > issue due to wrong dst refcounting (dst_clone() -> dst_hold_safe()). > > [...] Here is the summary with links: - [net,1/2,v2] net: bridge: fix vlan tunnel dst null pointer dereference https://git.kernel.org/netdev/net/c/58e2071742e3 - [net,2/2,v2] net: bridge: fix vlan tunnel dst refcnt when egressing https://git.kernel.org/netdev/net/c/cfc579f9d89a You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
From: Nikolay Aleksandrov <nikolay@nvidia.com> Hi, These two fixes take care of tunnel_dst problems in the vlan tunnel egress path. Patch 01 fixes a null ptr deref due to the lockless use of tunnel_dst pointer without checking it first, and patch 02 fixes a use-after-free issue due to wrong dst refcounting (dst_clone() -> dst_hold_safe()). Both fix the same commit and should be queued for stable backports: Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths") v2: no changes, added stable list to CC Thanks, Nik Nikolay Aleksandrov (2): net: bridge: fix vlan tunnel dst null pointer dereference net: bridge: fix vlan tunnel dst refcnt when egressing net/bridge/br_private.h | 4 ++-- net/bridge/br_vlan_tunnel.c | 38 +++++++++++++++++++++++-------------- 2 files changed, 26 insertions(+), 16 deletions(-)