From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755097AbbK3Vx2 (ORCPT ); Mon, 30 Nov 2015 16:53:28 -0500 Received: from out02.mta.xmission.com ([166.70.13.232]:42716 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753393AbbK3Vx0 (ORCPT ); Mon, 30 Nov 2015 16:53:26 -0500 From: ebiederm@xmission.com (Eric W. Biederman) To: David Miller Cc: Richard Weinberger , "netdev\@vger.kernel.org" , "linux-kernel\@vger.kernel.org" , "kernel-hardening\@lists.openwall.com" , bridge@lists.linux-foundation.org, Stephen Hemminger , Kees Cook References: <565B7F7D.80208@nod.at> Date: Mon, 30 Nov 2015 15:38:15 -0600 In-Reply-To: (Kees Cook's message of "Mon, 30 Nov 2015 12:14:41 -0800") Message-ID: <87egf7183c.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX19gPx8tzZjCLDB28yOPQmkO10B40s8N4Bg= X-SA-Exim-Connect-IP: 70.59.167.217 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.7 XMSubLong Long Subject * -0.0 BAYES_40 BODY: Bayes spam probability is 20 to 40% * [score: 0.2695] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa06 1397; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: XMission; sa06 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;David Miller X-Spam-Relay-Country: X-Spam-Timing: total 278 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 3.3 (1.2%), b_tie_ro: 2.2 (0.8%), parse: 1.09 (0.4%), extract_message_metadata: 17 (5.9%), get_uri_detail_list: 1.40 (0.5%), tests_pri_-1000: 6 (2.0%), tests_pri_-950: 1.20 (0.4%), tests_pri_-900: 1.00 (0.4%), tests_pri_-400: 27 (9.6%), check_bayes: 26 (9.2%), b_tokenize: 8 (2.9%), b_tok_get_all: 8 (2.9%), b_comp_prob: 2.4 (0.9%), b_tok_touch_all: 4.6 (1.7%), b_finish: 0.67 (0.2%), tests_pri_0: 216 (77.6%), tests_pri_500: 3.8 (1.4%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH net] bridge: Only call /sbin/bridge-stp for the initial network namespace X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 24 Sep 2014 11:00:52 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There is no defined mechanism to pass network namespace information into /sbin/bridge-stp therefore don't even try to invoke it except for bridge devices in the initial network namespace. It is possible for unprivileged users to cause /sbin/bridge-stp to be invoked for any network device name which if /sbin/bridge-stp does not guard against unreasonable arguments or being invoked twice on the same network device could cause problems. Signed-off-by: "Eric W. Biederman" --- net/bridge/br_stp_if.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c index 5396ff08af32..742fa89528ab 100644 --- a/net/bridge/br_stp_if.c +++ b/net/bridge/br_stp_if.c @@ -142,7 +142,9 @@ static void br_stp_start(struct net_bridge *br) char *envp[] = { NULL }; struct net_bridge_port *p; - r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC); + r = -ENOENT; + if (dev_net(br->dev) == &init_net) + r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC); spin_lock_bh(&br->lock); -- 2.2.1