On Thu, Dec 18, 2025 at 10:37:36AM -0500, Sasha Levin wrote:
From: Hangbin Liu liuhangbin@gmail.com
[ Upstream commit 847748fc66d08a89135a74e29362a66ba4e3ab15 ]
hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock. On the other hand, before return the port device, we need to hold the device reference to avoid UaF in the caller function.
Suggested-by: Paolo Abeni pabeni@redhat.com Fixes: 9c10dd8eed74 ("net: hsr: Create and export hsr_get_port_ndev()") Signed-off-by: Hangbin Liu liuhangbin@gmail.com Reviewed-by: Simon Horman horms@kernel.org Link: https://patch.msgid.link/20250905091533.377443-4-liuhangbin@gmail.com Signed-off-by: Paolo Abeni pabeni@redhat.com [ Drop multicast filtering changes ] Signed-off-by: Sasha Levin sashal@kernel.org
net/hsr/hsr_device.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c index 386aba50930a3..acbd77ce6afce 100644 --- a/net/hsr/hsr_device.c +++ b/net/hsr/hsr_device.c @@ -682,9 +682,14 @@ struct net_device *hsr_get_port_ndev(struct net_device *ndev, struct hsr_priv *hsr = netdev_priv(ndev); struct hsr_port *port;
- rcu_read_lock(); hsr_for_each_port(hsr, port)
if (port->type == pt)
if (port->type == pt) {dev_hold(port->dev);rcu_read_unlock(); return port->dev;}- rcu_read_unlock(); return NULL;
} EXPORT_SYMBOL(hsr_get_port_ndev); -- 2.51.0
Thanks for the fix. This looks good to me since we are missing commit 161087db66d6 ("net: ti: icssg-prueth: Add Support for Multicast filtering with VLAN in HSR mode") on 6.12.
Reviewed-by: Hangbin Liu liuhangbin@gmail.com