2021-11-18 19:51:57

by Volodymyr Mytnyk

Subject: [PATCH net] net: marvell: prestera: fix double free issue on err path

From: Volodymyr Mytnyk <[email protected]>

fix error path handling in prestera_bridge_port_join() that
cases prestera driver to crash (see below).

Trace:
Internal error: Oops: 96000044 [#1] SMP
Modules linked in: prestera_pci prestera uio_pdrv_genirq
CPU: 1 PID: 881 Comm: ip Not tainted 5.15.0 #1
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : prestera_bridge_destroy+0x2c/0xb0 [prestera]
lr : prestera_bridge_port_join+0x2cc/0x350 [prestera]
sp : ffff800011a1b0f0
...
x2 : ffff000109ca6c80 x1 : dead000000000100 x0 : dead000000000122
Call trace:
prestera_bridge_destroy+0x2c/0xb0 [prestera]
prestera_bridge_port_join+0x2cc/0x350 [prestera]
prestera_netdev_port_event.constprop.0+0x3c4/0x450 [prestera]
prestera_netdev_event_handler+0xf4/0x110 [prestera]
raw_notifier_call_chain+0x54/0x80
call_netdevice_notifiers_info+0x54/0xa0
__netdev_upper_dev_link+0x19c/0x380

Fixes: e1189d9a5fbe ("net: marvell: prestera: Add Switchdev driver implementation")
Signed-off-by: Volodymyr Mytnyk <[email protected]>
---
drivers/net/ethernet/marvell/prestera/prestera_switchdev.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
index 79f2fca0d412..b4599fe4ca8d 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
@@ -497,8 +497,8 @@ int prestera_bridge_port_join(struct net_device *br_dev,

br_port = prestera_bridge_port_add(bridge, port->dev);
if (IS_ERR(br_port)) {
- err = PTR_ERR(br_port);
- goto err_brport_create;
+ prestera_bridge_put(bridge);
+ return PTR_ERR(br_port);
}

err = switchdev_bridge_port_offload(br_port->dev, port->dev, NULL,
@@ -519,8 +519,6 @@ int prestera_bridge_port_join(struct net_device *br_dev,
switchdev_bridge_port_unoffload(br_port->dev, NULL, NULL, NULL);
err_switchdev_offload:
prestera_bridge_port_put(br_port);
-err_brport_create:
- prestera_bridge_put(bridge);
return err;
}

--
2.7.4

2021-11-19 12:00:42

by patchwork-bot+netdevbpf

Subject: Re: [PATCH net] net: marvell: prestera: fix double free issue on err path

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <[email protected]>:

On Thu, 18 Nov 2021 21:51:40 +0200 you wrote:
> From: Volodymyr Mytnyk <[email protected]>
>
> fix error path handling in prestera_bridge_port_join() that
> cases prestera driver to crash (see below).
>
> Trace:
> Internal error: Oops: 96000044 [#1] SMP
> Modules linked in: prestera_pci prestera uio_pdrv_genirq
> CPU: 1 PID: 881 Comm: ip Not tainted 5.15.0 #1
> pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : prestera_bridge_destroy+0x2c/0xb0 [prestera]
> lr : prestera_bridge_port_join+0x2cc/0x350 [prestera]
> sp : ffff800011a1b0f0
> ...
> x2 : ffff000109ca6c80 x1 : dead000000000100 x0 : dead000000000122
> Call trace:
> prestera_bridge_destroy+0x2c/0xb0 [prestera]
> prestera_bridge_port_join+0x2cc/0x350 [prestera]
> prestera_netdev_port_event.constprop.0+0x3c4/0x450 [prestera]
> prestera_netdev_event_handler+0xf4/0x110 [prestera]
> raw_notifier_call_chain+0x54/0x80
> call_netdevice_notifiers_info+0x54/0xa0
> __netdev_upper_dev_link+0x19c/0x380
>
> [...]

Here is the summary with links:
- [net] net: marvell: prestera: fix double free issue on err path
https://git.kernel.org/netdev/net/c/e8d032507cb7

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html