netdev - Re: [patch net 1/2] mlxsw: spectrum: Fix refcount bug on span entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Nov 2016 14:49:28 +0200
From:   Ido Schimmel <idosch@...sch.org>
To:     Jiri Pirko <jiri@...nulli.us>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, yotamg@...lanox.com,
        arkadis@...lanox.com, idosch@...lanox.com, eladr@...lanox.com,
        nogahf@...lanox.com, ogerlitz@...lanox.com
Subject: Re: [patch net 1/2] mlxsw: spectrum: Fix refcount bug on span entries

On Fri, Nov 11, 2016 at 11:20:41AM +0100, Jiri Pirko wrote:
> From: Yotam Gigi <yotamg@...lanox.com>
> 
> When binding port to a newly created span entry, its refcount is set 0
> even though it has a bound port. That leeds to unexpected behaviour when

s/leeds/leads/

> the user tries to delete that port from the span entry.
> 
> Change the binding process to increase the refcount of the bound entry
> even if the entry is newly created, and add warning on the process of
> removing bound port from entry when its refcount is 0.
> 
> Fixes: 763b4b70afcd3 ("mlxsw: spectrum: Add support in matchall mirror TC offloading")

You only need the first 12 characters.

> Signed-off-by: Yotam Gigi <yotamg@...lanox.com>
> Signed-off-by: Jiri Pirko <jiri@...lanox.com>
> ---
>  drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
> index 1ec0a4c..d75c1ff 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
> @@ -269,17 +269,18 @@ static struct mlxsw_sp_span_entry
>  	struct mlxsw_sp_span_entry *span_entry;
>  
>  	span_entry = mlxsw_sp_span_entry_find(port);
> -	if (span_entry) {
> -		span_entry->ref_count++;
> -		return span_entry;
> -	}
> +	if (!span_entry)
> +		span_entry = mlxsw_sp_span_entry_create(port);
>  
> -	return mlxsw_sp_span_entry_create(port);
> +	span_entry->ref_count++;

mlxsw_sp_span_entry_create() can return NULL. You can look at
mlxsw_sp_fib_entry_get() for reference.

> +	return span_entry;
>  }
>  
>  static int mlxsw_sp_span_entry_put(struct mlxsw_sp *mlxsw_sp,
>  				   struct mlxsw_sp_span_entry *span_entry)
>  {
> +	WARN_ON(!span_entry->ref_count);
> +
>  	if (--span_entry->ref_count == 0)
>  		mlxsw_sp_span_entry_destroy(mlxsw_sp, span_entry);
>  	return 0;
> -- 
> 2.7.4
>