Received: by 10.223.185.111 with SMTP id b44csp919908wrg; Fri, 9 Mar 2018 16:53:24 -0800 (PST) X-Google-Smtp-Source: AG47ELs5IWiAiccMtu92p0e3e4PBJLyXtWoRz7pmX0E5EHsX4V6rvAjiiWpoxK6LfbjGdgemx06o X-Received: by 10.101.77.201 with SMTP id q9mr299423pgt.395.1520643204766; Fri, 09 Mar 2018 16:53:24 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520643204; cv=none; d=google.com; s=arc-20160816; b=ZinW+uRqEp0xnHxFhEB+Q0Dd7cl3gpahw30n2UMh34Z5mA0mzMwtxzTiJ3+XJkIEGr 43BZQ5uhJV3nSCqq6mKe4IhLCfyvHtSJyjKC6TFUECzV464ZaM3YAknVOZ1QO8hBtjAh wPZg9elKm6lABYSyb1BroX4A6J0z9B+mlXKi54a5Q7KXnLuLAU9oZ4XjC6BJu5d1cPA5 tzjwkbKob2z3cL08ikXUSNLjvvuq6sgUYxBgwqInwXrfclgzHwbSQxVlLf6NtqN+cHec GPIXVQmsXzWcZpipC0PFlG+XFMlNgsZ8dMo2f0rPQUqixQ+I+5UCSNUR2kIg9slcMOO/ tK7Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=k16rjpRO0UZhLgvObuJcx9QJrzlcFvbHNh1yVr4DOzk=; b=fOBFIIMPCxjZXyiGNUY6ORa5vt9XUHJBIfiXOqag3VNNA5b44Z42+A8txkn74g8/X4 /cDO+rm6qYihlanRKSonCBlB7kdoV6aiucVIXUNhZoGgPKEENhTXd6hUIu/SZG7+cw5G oA/9GUedmjimW2SYjFkqIIrPP7b2/gmnG0oKLU24xNcq4Kk8MrJhIVKQqDFa14K/OMHH jbjyWsczEtQtbF5C49aE5NDMBDeHbd2jlJK+wJqBJ1AorAw8MuanepVMJ6y9jlUSO9mu 2tkfrMkiwJVgWuQa4tdr06pboYlW8kvO7SnNIWP8LZkL0RtL5THF8SlyL+pIqVkWLXBI SPZw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j11si1742450pfi.57.2018.03.09.16.53.10; Fri, 09 Mar 2018 16:53:24 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933033AbeCJAwV (ORCPT + 99 others); Fri, 9 Mar 2018 19:52:21 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:38550 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932819AbeCJATJ (ORCPT ); Fri, 9 Mar 2018 19:19:09 -0500 Received: from localhost (unknown [185.236.200.248]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 0F428EF8; Sat, 10 Mar 2018 00:19:08 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiong Zhou , Xin Long , "David S. Miller" Subject: [PATCH 3.18 08/21] bridge: check brport attr show in brport_show Date: Fri, 9 Mar 2018 16:18:30 -0800 Message-Id: <20180310001801.531714893@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180310001801.045114869@linuxfoundation.org> References: <20180310001801.045114869@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Xin Long [ Upstream commit 1b12580af1d0677c3c3a19e35bfe5d59b03f737f ] Now br_sysfs_if file flush doesn't have attr show. To read it will cause kernel panic after users chmod u+r this file. Xiong found this issue when running the commands: ip link add br0 type bridge ip link add type veth ip link set veth0 master br0 chmod u+r /sys/devices/virtual/net/veth0/brport/flush timeout 3 cat /sys/devices/virtual/net/veth0/brport/flush kernel crashed with NULL a pointer dereference call trace. This patch is to fix it by return -EINVAL when brport_attr->show is null, just the same as the check for brport_attr->store in brport_store(). Fixes: 9cf637473c85 ("bridge: add sysfs hook to flush forwarding table") Reported-by: Xiong Zhou Signed-off-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_sysfs_if.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/bridge/br_sysfs_if.c +++ b/net/bridge/br_sysfs_if.c @@ -225,6 +225,9 @@ static ssize_t brport_show(struct kobjec struct brport_attribute *brport_attr = to_brport_attr(attr); struct net_bridge_port *p = to_brport(kobj); + if (!brport_attr->show) + return -EINVAL; + return brport_attr->show(p, buf); }