netdev - [PATCH v5 net-next 01/10] net: dsa: avoid refcount warnings when ->port_{fdb,mdb}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20211024171757.3753288-2-vladimir.oltean@nxp.com>
Date:   Sun, 24 Oct 2021 20:17:48 +0300
From:   Vladimir Oltean <vladimir.oltean@....com>
To:     netdev@...r.kernel.org
Cc:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Florian Fainelli <f.fainelli@...il.com>,
        Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Vladimir Oltean <olteanv@...il.com>,
        UNGLinuxDriver@...rochip.com, DENG Qingfang <dqfext@...il.com>,
        Kurt Kanzenbach <kurt@...utronix.de>,
        Hauke Mehrtens <hauke@...ke-m.de>,
        Woojung Huh <woojung.huh@...rochip.com>,
        Sean Wang <sean.wang@...iatek.com>,
        Landen Chao <Landen.Chao@...iatek.com>,
        Alexandre Belloni <alexandre.belloni@...tlin.com>,
        George McCollister <george.mccollister@...il.com>,
        John Crispin <john@...ozen.org>,
        Aleksander Jan Bajkowski <olek2@...pl>,
        Egil Hjelmeland <privat@...l-hjelmeland.no>,
        Oleksij Rempel <o.rempel@...gutronix.de>,
        Prasanna Vengateshan <prasanna.vengateshan@...rochip.com>,
        Ansuel Smith <ansuelsmth@...il.com>,
        Alvin Šipraga <alsi@...g-olufsen.dk>,
        Claudiu Manoil <claudiu.manoil@....com>
Subject: [PATCH v5 net-next 01/10] net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error

At present, when either of ds->ops->port_fdb_del() or ds->ops->port_mdb_del()
return a non-zero error code, we attempt to save the day and keep the
data structure associated with that switchdev object, as the deletion
procedure did not complete.

However, the way in which we do this is suspicious to the checker in
lib/refcount.c, who thinks it is buggy to increment a refcount that
became zero, and that this is indicative of a use-after-free.

Fixes: 161ca59d39e9 ("net: dsa: reference count the MDB entries at the cross-chip notifier level")
Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>
---
v4->v5: patch is new.

This is a minor fix and slightly unrelated to the series, but my other
patches touch this area and there isn't enough time until the merge
window to wait for another net -> net-next merge. I've annotated it with
a Fixes: tag and sent it to net-next (also made it the first patch), in
the idea that if it could be picked up by AUTOSEL it would be nice, and
if not, the problem it fixes isn't so critical anyway.

 net/dsa/switch.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 2b1b21bde830..8f8ed8248c2c 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -266,7 +266,7 @@ static int dsa_port_do_mdb_del(struct dsa_port *dp,
 
 	err = ds->ops->port_mdb_del(ds, port, mdb);
 	if (err) {
-		refcount_inc(&a->refcount);
+		refcount_set(&a->refcount, 1);
 		return err;
 	}
 
@@ -333,7 +333,7 @@ static int dsa_port_do_fdb_del(struct dsa_port *dp, const unsigned char *addr,
 
 	err = ds->ops->port_fdb_del(ds, port, addr, vid);
 	if (err) {
-		refcount_inc(&a->refcount);
+		refcount_set(&a->refcount, 1);
 		return err;
 	}
 
-- 
2.25.1