[Bridge] [PATCH net] net: bridge: fix per-port vlan stats use-after-free on destruction

2018-11-12 Thread Nikolay Aleksandrov
Syzbot reported a use-after-free of the global vlan context on port vlan destruction. When I added per-port vlan stats I missed the fact that the global vlan context can be freed before the per-port vlan rcu callback. There're a few different ways to deal with this, I've chosen to add a new

Re: [Bridge] [PATCH tip/core/rcu 33/41] net/bridge: Replace call_rcu_bh() and rcu_barrier_bh()

2018-11-12 Thread Nikolay Aleksandrov
On 11/11/18 9:44 PM, Paul E. McKenney wrote: > Now that call_rcu()'s callback is not invoked until after all bh-disable > regions of code have completed (in addition to explicitly marked > RCU read-side critical sections), call_rcu() can be used in place > of call_rcu_bh(). Similarly,

[Bridge] KASAN: use-after-free Read in nbp_vlan_rcu_free

2018-11-12 Thread syzbot
Hello, syzbot found the following crash on: HEAD commit:e12e00e388de Merge tag 'kbuild-fixes-v4.20' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14cdb6f540 kernel config: https://syzkaller.appspot.com/x/.config?x=8f215f21f041a0d7

[Bridge] [PATCH tip/core/rcu 33/41] net/bridge: Replace call_rcu_bh() and rcu_barrier_bh()

2018-11-12 Thread Paul E. McKenney
Now that call_rcu()'s callback is not invoked until after all bh-disable regions of code have completed (in addition to explicitly marked RCU read-side critical sections), call_rcu() can be used in place of call_rcu_bh(). Similarly, rcu_barrier() can be used in place of rcu_barrier_bh(). This

Re: [Bridge] [PATCH net-next 0/9] Use __vlan_hwaccel_*() helpers

2018-11-12 Thread Tariq Toukan
On 09/11/2018 6:45 AM, David Miller wrote: > From: Michał Mirosław > Date: Fri, 09 Nov 2018 00:17:58 +0100 > >> This series removes from networking core and driver code an assumption >> about how VLAN tag presence is stored in an skb. This will allow to free >> up overloading of VLAN.CFI bit

Re: [Bridge] KASAN: use-after-free Read in nbp_vlan_rcu_free

2018-11-12 Thread nikolay
On 12 November 2018 06:51:02 CET, syzbot wrote: >Hello, > >syzbot found the following crash on: > >HEAD commit:e12e00e388de Merge tag 'kbuild-fixes-v4.20' of >git://git.k.. >git tree: upstream >console output: >https://syzkaller.appspot.com/x/log.txt?x=14cdb6f540 >kernel config: