From patchwork Fri Apr 27 18:16:09 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 905899 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=networkplumber.org Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=networkplumber-org.20150623.gappssmtp.com header.i=@networkplumber-org.20150623.gappssmtp.com header.b="FjHofJYh"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40Xhvp4dzWz9s0w for ; Sat, 28 Apr 2018 04:16:22 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757678AbeD0SQP (ORCPT ); Fri, 27 Apr 2018 14:16:15 -0400 Received: from mail-pg0-f67.google.com ([74.125.83.67]:37706 "EHLO mail-pg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757361AbeD0SQN (ORCPT ); Fri, 27 Apr 2018 14:16:13 -0400 Received: by mail-pg0-f67.google.com with SMTP id a13-v6so2139807pgu.4 for ; Fri, 27 Apr 2018 11:16:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=o7vRifWibcaYcAEkqNEezUTXhJ2Fp/LfDcCfhVAvztk=; b=FjHofJYhxXv7oeOm13N9AY1LLIsE8d1zMrBSMsENOtkEV07FTQTsfWRBm554FNEBD4 zhGtY2IGY4FpN8Vful/bv89Wso+7B9Y/uA3fjhBZ/okgXX+qsqv/Jiq0SgQDtarPT/DN w4LfPeYBtln2fqkKnMrUCYi5kyLPA0mR/QmpUHreyjneA0Qx9K4gSA2uprlrk0OW1T1S cjUTWlOKMZtS4pw4t9kNhBEwmWyyBs7J6PUflPrmdfnX7trswUM2mVfmUoTtlRB7GHVP A5DYKshN1CoZgfoOTN91U5vF73vQ1sXUNWJPFCEVA8MvjnGtA4kVxsg/9D2y67qm9cCv bdnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=o7vRifWibcaYcAEkqNEezUTXhJ2Fp/LfDcCfhVAvztk=; b=gKqymYGfpnlj9SZpcOv23xLZ97PGqeEvo4PfoSbUmfd0wvdQrGvvCu6v6L3DzOGm7P 9gARlMH8JgMNrXtCS9Dc0cOftES2wX3k/lsMcOPK+DTWMCQ5wLBr1bmaxPhtxVCmJGzj VFDNCxme0ypvHuzqwqDK5s0rGgkq7kGsBPQdLpEgdOg93nRlnc2LX5qMwR6dgR4ie6gS wMrEvuaKqR6duIdBqzkhni3F6Hix6/KFy0D/nSUP4MfLEmS99a6qdMFt7ItHFeBPsQoc T/KpI6+i4bY7rftIfNRNPR0dYLLXWOaL71vz/f+M550keBOB0TAo/B/dFw1+tMYnmxZ0 JvFQ== X-Gm-Message-State: ALQs6tAYxqdCDMmXVmJV2a/EFPzk11gnlYaNCYsselv34fzVjqmdYfZu CA3M++TPtmqBdj/qPJ2PeIL2/BNMUDY= X-Google-Smtp-Source: AB8JxZrzk7IutCYuToq6A0ZXQsjgyik2/O/VdalDZVdFYOrYz01YFOKrsNSWNFYm4p6XyEbu43ruNQ== X-Received: by 10.98.65.93 with SMTP id o90mr3138686pfa.140.1524852972723; Fri, 27 Apr 2018 11:16:12 -0700 (PDT) Received: from xeon-e3.lan (204-195-71-95.wavecable.com. [204.195.71.95]) by smtp.gmail.com with ESMTPSA id m4sm5215929pfk.151.2018.04.27.11.16.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 27 Apr 2018 11:16:11 -0700 (PDT) From: Stephen Hemminger X-Google-Original-From: Stephen Hemminger To: pablo@netfilter.org, kadlec@blackhole.kfki.hu, fw@strlen.de, davem@davemloft.net Cc: netfilter-devel@vger.kernel.org, bridge@lists.linux-foundation.org, netdev@vger.kernel.org, Stephen Hemminger , Stephen Hemminger Subject: [PATCH net] bridge: netfilter stp fix reference to uninitialized data Date: Fri, 27 Apr 2018 11:16:09 -0700 Message-Id: <20180427181609.3103-1-sthemmin@microsoft.com> X-Mailer: git-send-email 2.17.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org The destination mac (destmac) is only valid if EBT_DESTMAC flag is set. Fix by changing the order of the comparison to look for the flag first. Reported-by: syzbot+5c06e318fc558cc27823@syzkaller.appspotmail.com Signed-off-by: Stephen Hemminger --- Note: no fixes since this bug goes back to pre-git days. Should go to stable as well. net/bridge/netfilter/ebt_stp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c index 47ba98db145d..46c1fe7637ea 100644 --- a/net/bridge/netfilter/ebt_stp.c +++ b/net/bridge/netfilter/ebt_stp.c @@ -161,8 +161,8 @@ static int ebt_stp_mt_check(const struct xt_mtchk_param *par) /* Make sure the match only receives stp frames */ if (!par->nft_compat && (!ether_addr_equal(e->destmac, eth_stp_addr) || - !is_broadcast_ether_addr(e->destmsk) || - !(e->bitmask & EBT_DESTMAC))) + !(e->bitmask & EBT_DESTMAC) || + !is_broadcast_ether_addr(e->destmsk))) return -EINVAL; return 0;