rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bridge: Fix mglist corruption that leads to memory corruption (F13#650151)

This commit is contained in:
Chuck Ebbert 2011-02-12 11:12:46 -05:00
parent c7ff2c5553
commit 6e3a83fee3
2 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch Normal file
View File

@ -0,0 +1,42 @@
bridge: Fix mglist corruption that leads to memory corruption
The list mp->mglist is used to indicate whether a multicast group
is active on the bridge interface itself as opposed to one of the
constituent interfaces in the bridge.
Unfortunately the operation that adds the mp->mglist node to the
list neglected to check whether it has already been added. This
leads to list corruption in the form of nodes pointing to itself.
Normally this would be quite obvious as it would cause an infinite
loop when walking the list. However, as this list is never actually
walked (which means that we don't really need it, I'll get rid of
it in a subsequent patch), this instead is hidden until we perform
a delete operation on the affected nodes.
As the same node may now be pointed to by more than one node, the
delete operations can then cause modification of freed memory.
This was observed in practice to cause corruption in 512-byte slabs,
most commonly leading to crashes in jbd2.
Thanks to Josef Bacik for pointing me in the right direction.
Reported-by: Ian Page Hands <ihands@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f701a21..802d3f8 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -719,7 +719,8 @@ static int br_multicast_add_group(struct net_bridge *br,
goto err;
if (!port) {
- hlist_add_head(&mp->mglist, &br->mglist);
+ if (hlist_unhashed(&mp->mglist))
+ hlist_add_head(&mp->mglist, &br->mglist);
mod_timer(&mp->timer, now + br->multicast_membership_interval);
goto out;
}

9
kernel.spec
View File

@ -829,6 +829,9 @@ Patch13704: hostap_cs-fix-sleeping-function-called-from-invalid-context.patch
# rhbz #673207
Patch13705: sunrpc-kernel-panic-when-mount-nfsv4.patch
# rhbz #650151 (F13)
Patch13706: bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch
%endif
BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@ -1561,6 +1564,9 @@ ApplyPatch hostap_cs-fix-sleeping-function-called-from-invalid-context.patch
# rhbz #673207
ApplyPatch sunrpc-kernel-panic-when-mount-nfsv4.patch
# rhbz #650151 (F13)
ApplyPatch bridge-fix-mglist-corruption-that-leads-to-memory-corruption.patch
# END OF PATCH APPLICATIONS
%endif
@ -2147,6 +2153,9 @@ fi
# and build.
%changelog
* Sat Feb 12 2011 Chuck Ebbert <cebbert@redhat.com>
- bridge: Fix mglist corruption that leads to memory corruption (F13#650151)
* Wed Feb 11 2011 Matthew Garrett <mjg@redhat.com> 2.6.35.11-84
- linux-2.6-acpi-fix-alias.patch: Fix ACPI object aliasing (#608648)