| Message ID | 20220503115728.834457-3-vladimir.oltean@nxp.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Ocelot VCAP fixes | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Clearly marked for net |
| netdev/fixes_present | success | Fixes tag present in non-next series |
| netdev/subject_prefix | success | Link |
| netdev/cover_letter | success | Series has a cover letter |
| netdev/patch_count | success | Link |
| netdev/header_inline | success | No static functions without inline keyword in header files |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/cc_maintainers | success | CCed 9 of 9 maintainers |
| netdev/build_clang | success | Errors and warnings before: 0 this patch: 0 |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Signed-off-by tag matches author and committer |
| netdev/verify_fixes | success | Fixes tag looks correct |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 8 lines checked |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/source_inline | success | Was 0 now: 0 |
On Tue, May 03, 2022 at 02:57:24PM +0300, Vladimir Oltean wrote: > The error path of ocelot_flower_parse() removes a VCAP filter from > ocelot->traps, but the main deletion path - ocelot_vcap_filter_del() - > does not. > > So functions such as felix_update_trapping_destinations() can still > access the freed VCAP filter via ocelot->traps. > > Fix this bug by removing the filter from ocelot->traps when it gets > deleted. > > Fixes: e42bd4ed09aa ("net: mscc: ocelot: keep traps in a list") > Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> > --- > drivers/net/ethernet/mscc/ocelot_vcap.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/ethernet/mscc/ocelot_vcap.c b/drivers/net/ethernet/mscc/ocelot_vcap.c > index 1e74bdb215ec..571d43e59f63 100644 > --- a/drivers/net/ethernet/mscc/ocelot_vcap.c > +++ b/drivers/net/ethernet/mscc/ocelot_vcap.c > @@ -1232,6 +1232,8 @@ static void ocelot_vcap_block_remove_filter(struct ocelot *ocelot, > if (ocelot_vcap_filter_equal(filter, tmp)) { > ocelot_vcap_filter_del_aux_resources(ocelot, tmp); > list_del(&tmp->list); > + if (!list_empty(&tmp->trap_list)) > + list_del(&tmp->trap_list); > kfree(tmp); > } > } > -- > 2.25.1 > This change introduces other breakage, please drop this patch set and allow me to come up with a different solution.
diff --git a/drivers/net/ethernet/mscc/ocelot_vcap.c b/drivers/net/ethernet/mscc/ocelot_vcap.c index 1e74bdb215ec..571d43e59f63 100644 --- a/drivers/net/ethernet/mscc/ocelot_vcap.c +++ b/drivers/net/ethernet/mscc/ocelot_vcap.c @@ -1232,6 +1232,8 @@ static void ocelot_vcap_block_remove_filter(struct ocelot *ocelot, if (ocelot_vcap_filter_equal(filter, tmp)) { ocelot_vcap_filter_del_aux_resources(ocelot, tmp); list_del(&tmp->list); + if (!list_empty(&tmp->trap_list)) + list_del(&tmp->trap_list); kfree(tmp); } }
The error path of ocelot_flower_parse() removes a VCAP filter from ocelot->traps, but the main deletion path - ocelot_vcap_filter_del() - does not. So functions such as felix_update_trapping_destinations() can still access the freed VCAP filter via ocelot->traps. Fix this bug by removing the filter from ocelot->traps when it gets deleted. Fixes: e42bd4ed09aa ("net: mscc: ocelot: keep traps in a list") Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> --- drivers/net/ethernet/mscc/ocelot_vcap.c | 2 ++ 1 file changed, 2 insertions(+)