netdev - [patch net 1/2] mlxsw: spectrum: Fix refcount bug on span entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Nov 2016 11:20:41 +0100
From:   Jiri Pirko <jiri@...nulli.us>
To:     netdev@...r.kernel.org
Cc:     davem@...emloft.net, yotamg@...lanox.com, arkadis@...lanox.com,
        idosch@...lanox.com, eladr@...lanox.com, nogahf@...lanox.com,
        ogerlitz@...lanox.com
Subject: [patch net 1/2] mlxsw: spectrum: Fix refcount bug on span entries

From: Yotam Gigi <yotamg@...lanox.com>

When binding port to a newly created span entry, its refcount is set 0
even though it has a bound port. That leeds to unexpected behaviour when
the user tries to delete that port from the span entry.

Change the binding process to increase the refcount of the bound entry
even if the entry is newly created, and add warning on the process of
removing bound port from entry when its refcount is 0.

Fixes: 763b4b70afcd3 ("mlxsw: spectrum: Add support in matchall mirror TC offloading")
Signed-off-by: Yotam Gigi <yotamg@...lanox.com>
Signed-off-by: Jiri Pirko <jiri@...lanox.com>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 1ec0a4c..d75c1ff 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -269,17 +269,18 @@ static struct mlxsw_sp_span_entry
 	struct mlxsw_sp_span_entry *span_entry;
 
 	span_entry = mlxsw_sp_span_entry_find(port);
-	if (span_entry) {
-		span_entry->ref_count++;
-		return span_entry;
-	}
+	if (!span_entry)
+		span_entry = mlxsw_sp_span_entry_create(port);
 
-	return mlxsw_sp_span_entry_create(port);
+	span_entry->ref_count++;
+	return span_entry;
 }
 
 static int mlxsw_sp_span_entry_put(struct mlxsw_sp *mlxsw_sp,
 				   struct mlxsw_sp_span_entry *span_entry)
 {
+	WARN_ON(!span_entry->ref_count);
+
 	if (--span_entry->ref_count == 0)
 		mlxsw_sp_span_entry_destroy(mlxsw_sp, span_entry);
 	return 0;
-- 
2.7.4