netdev - Re: [PATCH iwl-next v3 03/10] ice: Implement basic eswitch bridge setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZGtQffLjYdt14Lpg@corigine.com>
Date: Mon, 22 May 2023 13:22:37 +0200
From: Simon Horman <simon.horman@...igine.com>
To: Wojciech Drewek <wojciech.drewek@...el.com>
Cc: intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
	alexandr.lobakin@...el.com, david.m.ertman@...el.com,
	michal.swiatkowski@...ux.intel.com, marcin.szycik@...ux.intel.com,
	pawel.chmielewski@...el.com, sridhar.samudrala@...el.com,
	Dan Carpenter <dan.carpenter@...aro.org>
Subject: Re: [PATCH iwl-next v3 03/10] ice: Implement basic eswitch bridge
 setup

+Dan Carpenter

On Mon, May 22, 2023 at 11:05:35AM +0200, Wojciech Drewek wrote:
> With this patch, ice driver is able to track if the port
> representors or uplink port were added to the linux bridge in
> switchdev mode. Listen for NETDEV_CHANGEUPPER events in order to
> detect this. ice_esw_br data structure reflects the linux bridge
> and stores all the ports of the bridge (ice_esw_br_port) in
> xarray, it's created when the first port is added to the bridge and
> freed once the last port is removed. Note that only one bridge is
> supported per eswitch.
> 
> Bridge port (ice_esw_br_port) can be either a VF port representor
> port or uplink port (ice_esw_br_port_type). In both cases bridge port
> holds a reference to the VSI, VF's VSI in case of the PR and uplink
> VSI in case of the uplink. VSI's index is used as an index to the
> xarray in which ports are stored.
> 
> Add a check which prevents configuring switchdev mode if uplink is
> already added to any bridge. This is needed because we need to listen
> for NETDEV_CHANGEUPPER events to record if the uplink was added to
> the bridge. Netdevice notifier is registered after eswitch mode
> is changed top switchdev.
> 
> Signed-off-by: Wojciech Drewek <wojciech.drewek@...el.com>

...

> +static void
> +ice_eswitch_br_port_deinit(struct ice_esw_br *bridge,
> +			   struct ice_esw_br_port *br_port)
> +{
> +	struct ice_vsi *vsi = br_port->vsi;
> +
> +	if (br_port->type == ICE_ESWITCH_BR_UPLINK_PORT && vsi->back)
> +		vsi->back->br_port = NULL;
> +	else if (vsi->vf)
> +		vsi->vf->repr->br_port = NULL;
> +
> +	xa_erase(&bridge->ports, br_port->vsi_idx);
> +	kfree(br_port);
> +}

...

> +static int
> +ice_eswitch_br_port_unlink(struct ice_esw_br_offloads *br_offloads,
> +			   struct net_device *dev, int ifindex,
> +			   struct netlink_ext_ack *extack)
> +{
> +	struct ice_esw_br_port *br_port = ice_eswitch_br_netdev_to_port(dev);
> +
> +	if (!br_port) {
> +		NL_SET_ERR_MSG_MOD(extack,
> +				   "Port representor is not attached to any bridge");
> +		return -EINVAL;
> +	}
> +
> +	if (br_port->bridge->ifindex != ifindex) {
> +		NL_SET_ERR_MSG_MOD(extack,
> +				   "Port representor is attached to another bridge");
> +		return -EINVAL;
> +	}
> +
> +	ice_eswitch_br_port_deinit(br_port->bridge, br_port);

Hi Wojciech,

According to Smatch, ice_eswitch_br_port_deinit() will free br_port.

> +	ice_eswitch_br_verify_deinit(br_offloads, br_port->bridge);

But br_port is dereferenced here.

.../ice_eswitch_br.c:207 ice_eswitch_br_port_unlink() error: dereferencing freed memory 'br_port'

> +
> +	return 0;
> +}

...

--
pw-bot: cr