From: Stephen Hemminger <shemminger@vyatta.com>
Date: Tue, 14 Aug 2012 15:19:33 +0000 (-0700)
Subject: bridge: fix rcu dereference outside of rcu_read_lock
X-Git-Tag: v3.6-rc3~10^2~39
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c03307eab68d583ea6db917681afa14ed1fb3b84;p=pandora-kernel.git

bridge: fix rcu dereference outside of rcu_read_lock

Alternative solution for problem found by Linux Driver Verification
project (linuxtesting.org).

As it noted in the comment before the br_handle_frame_finish
function, this function should be called under rcu_read_lock.

The problem callgraph:
br_dev_xmit -> br_nf_pre_routing_finish_bridge_slow ->
 -> br_handle_frame_finish -> br_port_get_rcu -> rcu_dereference

And in this case there is no read-lock section.

Reported-by: Denis Efremov <yefremov.denis@gmail.com>
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed