From nobody Sun Feb 8 01:23:10 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB1B9C4167B for ; Tue, 20 Dec 2022 02:49:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232821AbiLTCtC (ORCPT ); Mon, 19 Dec 2022 21:49:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39970 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229647AbiLTCs7 (ORCPT ); Mon, 19 Dec 2022 21:48:59 -0500 Received: from mail-il1-x129.google.com (mail-il1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1747F13CC4 for ; Mon, 19 Dec 2022 18:48:58 -0800 (PST) Received: by mail-il1-x129.google.com with SMTP id o8so5738638ilo.1 for ; Mon, 19 Dec 2022 18:48:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google2022; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=frWLw2ZkVObcc07j9dtQMFLxjnvLrXU3PwzZGX4Mo7w=; b=eduU04r8hf3vvnHc0OMdNDtR057TK+Snzk8vQVcuXrsnOT88upRHhU9h+0XUMlna8a gUf4xd7jISw24azRqDOgbn3C38HFfLvqW/W+MqKYRsbWzlfhFY4LCwsuWU86Ek02VpmP lQCTtUQ128C8+W5PdwtcECwTcDBM42bnqb0RiKyV1qCgx6e7AMbgFw1RfGTtyWU7sTmD ZCmhq6FggXO8KcVAt4QeON0+KXKfFCn2lVsKbntLz3MyFlb7UI1zCEMvzEagSmAV2x3o x6UpeRgDSrU+4hJDnqANPAkpLGMoPKl0tNYn/TKlaS7lOG+0gxMpXZDY8S+iY7ujStgZ fU0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=frWLw2ZkVObcc07j9dtQMFLxjnvLrXU3PwzZGX4Mo7w=; b=762ADpz2lnIQYnDAdGQwidvcne12nJ+ILsunTdLO2dxwXciTRXRO2GoihAzCBgsnjw Htw0bnruMDFl011UtjbUMU6UcJCJuWN5dnGW9Jy30fqgWsBqlBqmFzhHzydfPWdx/axu /x8p/+DJN0Ax7dVlUM9VPdEQriF65LUdalYFVD1EXDpw0f5332nkaHFxempZeOoThisH 8/3QdMIekGVGtlf/2oi+iQ46KiqNoqHhl+0fxRk+/KOMMl94lq5OOg6pzoXF+w+avKgf XEHeyRgEU4AbqQ4UBOHnV0Cnn7ypfM1utVPTjCMh6KbtWQYy4/3iyMFvHND1P8t8TVeR sdKA== X-Gm-Message-State: ANoB5pn9n2FRhlxctYYimO0m/iSu8vOQmOCE9gj6UqL8uCveAtRu2LeH TaDQFntXQqVFB91Y7eawp7TV1Q== X-Google-Smtp-Source: AA0mqf7BWvvYPtstOR7XHomWWQoZlWrLYrQ2ES1K/rZlfQTN2lBkBV1cd6n+hJYADCwJYr1fNSjZeQ== X-Received: by 2002:a92:cac9:0:b0:302:bd25:c1a3 with SMTP id m9-20020a92cac9000000b00302bd25c1a3mr18694114ilq.21.1671504537395; Mon, 19 Dec 2022 18:48:57 -0800 (PST) Received: from dev-jgu.dev.purestorage.com ([208.88.159.128]) by smtp.googlemail.com with ESMTPSA id l17-20020a92d951000000b00305e3da5f7dsm3427582ilq.85.2022.12.19.18.48.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Dec 2022 18:48:56 -0800 (PST) From: Joy Gu To: bridge@lists.linux-foundation.org Cc: roopa@nvidia.com, razor@blackwall.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, joern@purestorage.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Joy Gu Subject: [PATCH] net: bridge: mcast: read ngrec once in igmp3/mld2 report Date: Mon, 19 Dec 2022 18:48:07 -0800 Message-Id: <20221220024807.36502-1-jgu@purestorage.com> X-Mailer: git-send-email 2.39.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In br_ip4_multicast_igmp3_report() and br_ip6_multicast_mld2_report(), "ih" or "mld2r" is a pointer into the skb header. It's dereferenced to get "num", which is used in the for-loop condition that follows. Compilers are free to not spend a register on "num" and dereference that pointer every time "num" would be used, i.e. every loop iteration. Which would be a bug if pskb_may_pull() (called by ip_mc_may_pull() or ipv6_mc_may_pull() in the loop body) were to change pointers pointing into the skb header, e.g. by freeing "skb->head". We can avoid this by using READ_ONCE(). Suggested-by: Joern Engel Signed-off-by: Joy Gu --- net/bridge/br_multicast.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index 48170bd3785e..2ac4b099e00d 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -2624,11 +2624,11 @@ static int br_ip4_multicast_igmp3_report(struct net= _bridge_mcast *brmctx, bool changed =3D false; int err =3D 0; u16 nsrcs; =20 ih =3D igmpv3_report_hdr(skb); - num =3D ntohs(ih->ngrec); + num =3D ntohs(READ_ONCE(ih->ngrec)); len =3D skb_transport_offset(skb) + sizeof(*ih); =20 for (i =3D 0; i < num; i++) { len +=3D sizeof(*grec); if (!ip_mc_may_pull(skb, len)) @@ -2750,11 +2750,11 @@ static int br_ip6_multicast_mld2_report(struct net_= bridge_mcast *brmctx, =20 if (!ipv6_mc_may_pull(skb, sizeof(*mld2r))) return -EINVAL; =20 mld2r =3D (struct mld2_report *)icmp6_hdr(skb); - num =3D ntohs(mld2r->mld2r_ngrec); + num =3D ntohs(READ_ONCE(mld2r->mld2r_ngrec)); len =3D skb_transport_offset(skb) + sizeof(*mld2r); =20 for (i =3D 0; i < num; i++) { __be16 *_nsrcs, __nsrcs; u16 nsrcs; --=20 2.39.0