net: bridge: mcast: add and enforce startup query interval minimum

As reported[1] if startup query interval is set too low in combination with
large number of startup queries and we have multiple bridges or even a
single bridge with multiple querier vlans configured we can crash the
machine. Add a 1 second minimum which must be enforced by overwriting the
value if set lower (i.e. without returning an error) to avoid breaking
user-space. If that happens a log message is emitted to let the admin know
that the startup interval has been set to the minimum. It doesn't make
sense to make the startup interval lower than the normal query interval
so use the same value of 1 second. The issue has been present since these
intervals could be user-controlled.

[1] https://lore.kernel.org/netdev/e8b9ce41-57b9-b6e2-a46a-ff9c791cf0ba@gmail.com/

Fixes: 97d043928e8c ("bridge: Add multicast count/interval sysfs entries")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 998da4a2d209258e9f2707a7c521ef99ec5820e7..de24098894897270bbae00f5efe546a05728cc7a 100644 (file)
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -4538,6 +4538,22 @@ void br_multicast_set_query_intvl(struct net_bridge_mcast *brmctx,
        brmctx->multicast_query_interval = intvl_jiffies;
 }
 
+void br_multicast_set_startup_query_intvl(struct net_bridge_mcast *brmctx,
+                                         unsigned long val)
+{
+       unsigned long intvl_jiffies = clock_t_to_jiffies(val);
+
+       if (intvl_jiffies < BR_MULTICAST_STARTUP_QUERY_INTVL_MIN) {
+               br_info(brmctx->br,
+                       "trying to set multicast startup query interval below minimum, setting to %lu (%ums)\n",
+                       jiffies_to_clock_t(BR_MULTICAST_STARTUP_QUERY_INTVL_MIN),
+                       jiffies_to_msecs(BR_MULTICAST_STARTUP_QUERY_INTVL_MIN));
+               intvl_jiffies = BR_MULTICAST_STARTUP_QUERY_INTVL_MIN;
+       }
+
+       brmctx->multicast_startup_query_interval = intvl_jiffies;
+}
+
 /**
  * br_multicast_list_adjacent - Returns snooped multicast addresses
  * @dev:       The bridge port adjacent to which to retrieve addresses

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 701dd8b8455e81c6f6954fe9633abc85b2ded890..2ff83d84230d3136747dbd12507d071855b53cf6 100644 (file)
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1369,7 +1369,7 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[],
        if (data[IFLA_BR_MCAST_STARTUP_QUERY_INTVL]) {
                u64 val = nla_get_u64(data[IFLA_BR_MCAST_STARTUP_QUERY_INTVL]);
 
-               br->multicast_ctx.multicast_startup_query_interval = clock_t_to_jiffies(val);
+               br_multicast_set_startup_query_intvl(&br->multicast_ctx, val);
        }
 
        if (data[IFLA_BR_MCAST_STATS_ENABLED]) {

diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 4ed7f11042e87e14316a755ab17cafbf552df94c..2187a0c3fd222ed9a256904fd9655ff299fce557 100644 (file)
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -29,6 +29,7 @@
 
 #define BR_MULTICAST_DEFAULT_HASH_MAX 4096
 #define BR_MULTICAST_QUERY_INTVL_MIN msecs_to_jiffies(1000)
+#define BR_MULTICAST_STARTUP_QUERY_INTVL_MIN BR_MULTICAST_QUERY_INTVL_MIN
 
 #define BR_HWDOM_MAX BITS_PER_LONG
 
@@ -966,6 +967,8 @@ size_t br_multicast_querier_state_size(void);
 size_t br_rports_size(const struct net_bridge_mcast *brmctx);
 void br_multicast_set_query_intvl(struct net_bridge_mcast *brmctx,
                                  unsigned long val);
+void br_multicast_set_startup_query_intvl(struct net_bridge_mcast *brmctx,
+                                         unsigned long val);
 
 static inline bool br_group_is_l2(const struct br_ip *group)
 {

diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index f5bd1114a434ddec42bc214f7e1e5d155978ac87..7b0c19772111cf88324579c1f3f01409afeade9d 100644 (file)
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -706,7 +706,7 @@ static ssize_t multicast_startup_query_interval_show(
 static int set_startup_query_interval(struct net_bridge *br, unsigned long val,
                                      struct netlink_ext_ack *extack)
 {
-       br->multicast_ctx.multicast_startup_query_interval = clock_t_to_jiffies(val);
+       br_multicast_set_startup_query_intvl(&br->multicast_ctx, val);
        return 0;
 }
 

diff --git a/net/bridge/br_vlan_options.c b/net/bridge/br_vlan_options.c
index bf1ac087427941ea3e136ac160ac6561c79d95cd..a6382973b3e7010e74d40ca7bed772a632b4d8ee 100644 (file)
--- a/net/bridge/br_vlan_options.c
+++ b/net/bridge/br_vlan_options.c
@@ -535,7 +535,7 @@ static int br_vlan_process_global_one_opts(const struct net_bridge *br,
                u64 val;
 
                val = nla_get_u64(tb[BRIDGE_VLANDB_GOPTS_MCAST_STARTUP_QUERY_INTVL]);
-               v->br_mcast_ctx.multicast_startup_query_interval = clock_t_to_jiffies(val);
+               br_multicast_set_startup_query_intvl(&v->br_mcast_ctx, val);
                *changed = true;
        }
        if (tb[BRIDGE_VLANDB_GOPTS_MCAST_QUERIER]) {