netdev - RE: [PATCH iwl-next v3 03/10] ice: Implement basic eswitch bridge setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 23 May 2023 10:09:06 +0000
From: "Drewek, Wojciech" <wojciech.drewek@...el.com>
To: Simon Horman <simon.horman@...igine.com>
CC: "intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, "Lobakin, Aleksander"
	<aleksander.lobakin@...el.com>, "Ertman, David M" <david.m.ertman@...el.com>,
	"michal.swiatkowski@...ux.intel.com" <michal.swiatkowski@...ux.intel.com>,
	"marcin.szycik@...ux.intel.com" <marcin.szycik@...ux.intel.com>,
	"Chmielewski, Pawel" <pawel.chmielewski@...el.com>, "Samudrala, Sridhar"
	<sridhar.samudrala@...el.com>, Dan Carpenter <dan.carpenter@...aro.org>
Subject: RE: [PATCH iwl-next v3 03/10] ice: Implement basic eswitch bridge
 setup



> -----Original Message-----
> From: Simon Horman <simon.horman@...igine.com>
> Sent: poniedziałek, 22 maja 2023 13:23
> To: Drewek, Wojciech <wojciech.drewek@...el.com>
> Cc: intel-wired-lan@...ts.osuosl.org; netdev@...r.kernel.org; Lobakin, Aleksander <aleksander.lobakin@...el.com>; Ertman, David M
> <david.m.ertman@...el.com>; michal.swiatkowski@...ux.intel.com; marcin.szycik@...ux.intel.com; Chmielewski, Pawel
> <pawel.chmielewski@...el.com>; Samudrala, Sridhar <sridhar.samudrala@...el.com>; Dan Carpenter <dan.carpenter@...aro.org>
> Subject: Re: [PATCH iwl-next v3 03/10] ice: Implement basic eswitch bridge setup
> 
> +Dan Carpenter
> 
> On Mon, May 22, 2023 at 11:05:35AM +0200, Wojciech Drewek wrote:
> > With this patch, ice driver is able to track if the port
> > representors or uplink port were added to the linux bridge in
> > switchdev mode. Listen for NETDEV_CHANGEUPPER events in order to
> > detect this. ice_esw_br data structure reflects the linux bridge
> > and stores all the ports of the bridge (ice_esw_br_port) in
> > xarray, it's created when the first port is added to the bridge and
> > freed once the last port is removed. Note that only one bridge is
> > supported per eswitch.
> >
> > Bridge port (ice_esw_br_port) can be either a VF port representor
> > port or uplink port (ice_esw_br_port_type). In both cases bridge port
> > holds a reference to the VSI, VF's VSI in case of the PR and uplink
> > VSI in case of the uplink. VSI's index is used as an index to the
> > xarray in which ports are stored.
> >
> > Add a check which prevents configuring switchdev mode if uplink is
> > already added to any bridge. This is needed because we need to listen
> > for NETDEV_CHANGEUPPER events to record if the uplink was added to
> > the bridge. Netdevice notifier is registered after eswitch mode
> > is changed top switchdev.
> >
> > Signed-off-by: Wojciech Drewek <wojciech.drewek@...el.com>
> 
> ...
> 
> > +static void
> > +ice_eswitch_br_port_deinit(struct ice_esw_br *bridge,
> > +			   struct ice_esw_br_port *br_port)
> > +{
> > +	struct ice_vsi *vsi = br_port->vsi;
> > +
> > +	if (br_port->type == ICE_ESWITCH_BR_UPLINK_PORT && vsi->back)
> > +		vsi->back->br_port = NULL;
> > +	else if (vsi->vf)
> > +		vsi->vf->repr->br_port = NULL;
> > +
> > +	xa_erase(&bridge->ports, br_port->vsi_idx);
> > +	kfree(br_port);
> > +}
> 
> ...
> 
> > +static int
> > +ice_eswitch_br_port_unlink(struct ice_esw_br_offloads *br_offloads,
> > +			   struct net_device *dev, int ifindex,
> > +			   struct netlink_ext_ack *extack)
> > +{
> > +	struct ice_esw_br_port *br_port = ice_eswitch_br_netdev_to_port(dev);
> > +
> > +	if (!br_port) {
> > +		NL_SET_ERR_MSG_MOD(extack,
> > +				   "Port representor is not attached to any bridge");
> > +		return -EINVAL;
> > +	}
> > +
> > +	if (br_port->bridge->ifindex != ifindex) {
> > +		NL_SET_ERR_MSG_MOD(extack,
> > +				   "Port representor is attached to another bridge");
> > +		return -EINVAL;
> > +	}
> > +
> > +	ice_eswitch_br_port_deinit(br_port->bridge, br_port);
> 
> Hi Wojciech,
> 
> According to Smatch, ice_eswitch_br_port_deinit() will free br_port.
> 
> > +	ice_eswitch_br_verify_deinit(br_offloads, br_port->bridge);
> 
> But br_port is dereferenced here.
> 
> .../ice_eswitch_br.c:207 ice_eswitch_br_port_unlink() error: dereferencing freed memory 'br_port'
> 
> > +
> > +	return 0;
> > +}

Thanks Simon,
I'll fix that in v4

> 
> ...
> 
> --
> pw-bot: cr