Patch "hsr: Add a rcu-read lock to hsr_forward_skb()." has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    hsr: Add a rcu-read lock to hsr_forward_skb().

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hsr-add-a-rcu-read-lock-to-hsr_forward_skb.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d02e1b606c4234d5b724914d53568dc5e128cbf8
Author: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
Date:   Tue Nov 29 17:48:09 2022 +0100

    hsr: Add a rcu-read lock to hsr_forward_skb().
    
    [ Upstream commit 5aa2820177af650293b2f9f1873c1f6f8e4ad7a4 ]
    
    hsr_forward_skb() a skb and keeps information in an on-stack
    hsr_frame_info. hsr_get_node() assigns hsr_frame_info::node_src which is
    from a RCU list. This pointer is used later in hsr_forward_do().
    I don't see a reason why this pointer can't vanish midway since there is
    no guarantee that hsr_forward_skb() is invoked from an RCU read section.
    
    Use rcu_read_lock() to protect hsr_frame_info::node_src from its
    assignment until it is no longer used.
    
    Fixes: f266a683a4804 ("net/hsr: Better frame dispatch")
    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 3e58d310b4d4..a8befa35841e 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -614,11 +614,13 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port *port)
 {
 	struct hsr_frame_info frame;
 
+	rcu_read_lock();
 	if (fill_frame_info(&frame, skb, port) < 0)
 		goto out_drop;
 
 	hsr_register_frame_in(frame.node_src, port, frame.sequence_nr);
 	hsr_forward_do(&frame);
+	rcu_read_unlock();
 	/* Gets called for ingress frames as well as egress from master port.
 	 * So check and increment stats for master port only here.
 	 */
@@ -633,6 +635,7 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port *port)
 	return;
 
 out_drop:
+	rcu_read_unlock();
 	port->dev->stats.tx_dropped++;
 	kfree_skb(skb);
 }