netdev - Re: [PATCH] net/mlx5: E-Switch, Fix some error pointer dereferences

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200604103255.GA8834@unreal>
Date:   Thu, 4 Jun 2020 13:32:55 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     Saeed Mahameed <saeedm@...lanox.com>,
        Vu Pham <vuhuong@...lanox.com>,
        Jakub Kicinski <kuba@...nel.org>, linux-rdma@...r.kernel.org,
        linux-netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH] net/mlx5: E-Switch, Fix some error pointer dereferences

+ netdev

On Wed, Jun 03, 2020 at 08:54:36PM +0300, Dan Carpenter wrote:
> We can't leave "counter" set to an error pointer.  Otherwise either it
> will lead to an error pointer dereference later in the function or it
> leads to an error pointer dereference when we call mlx5_fc_destroy().
>
> Fixes: 07bab9502641d ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> ---
>  .../net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c  | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
> index 9bda4fe2eafa7..5dc335e621c57 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
> @@ -162,10 +162,12 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,
>
>  	if (MLX5_CAP_ESW_INGRESS_ACL(esw->dev, flow_counter)) {
>  		counter = mlx5_fc_create(esw->dev, false);
> -		if (IS_ERR(counter))
> +		if (IS_ERR(counter)) {
>  			esw_warn(esw->dev,
>  				 "vport[%d] configure ingress drop rule counter failed\n",
>  				 vport->vport);
> +			counter = NULL;
> +		}
>  		vport->ingress.legacy.drop_counter = counter;
>  	}
>
> @@ -272,7 +274,7 @@ void esw_acl_ingress_lgcy_cleanup(struct mlx5_eswitch *esw,
>  	esw_acl_ingress_table_destroy(vport);
>
>  clean_drop_counter:
> -	if (!IS_ERR_OR_NULL(vport->ingress.legacy.drop_counter)) {
> +	if (vport->ingress.legacy.drop_counter) {
>  		mlx5_fc_destroy(esw->dev, vport->ingress.legacy.drop_counter);
>  		vport->ingress.legacy.drop_counter = NULL;
>  	}
> --
> 2.26.2
>