blob: dcccaf424113b098789cccdc68453b130550cf28 [file] [log] [blame]
From 0a02e85ee175f554bb734b0a5cbb492d95b362c0 Mon Sep 17 00:00:00 2001
From: Jiri Pirko <>
Date: Wed, 30 Oct 2019 11:04:22 +0200
Subject: [PATCH] mlxsw: core: Unpublish devlink parameters during reload
commit b7265a0df82c1716bf788096217083ed65a8bb14 upstream.
The devlink parameter "acl_region_rehash_interval" is a runtime
parameter whose value is stored in a dynamically allocated memory. While
reloading the driver, this memory is freed and then allocated again. A
use-after-free might happen if during this time frame someone tries to
retrieve its value.
Since commit 070c63f20f6c ("net: devlink: allow to change namespaces
during reload") the use-after-free can be reliably triggered when
reloading the driver into a namespace, as after freeing the memory (via
reload_down() callback) all the parameters are notified.
Fix this by unpublishing and then re-publishing the parameters during
Fixes: 98bbf70c1c41 ("mlxsw: spectrum: add "acl_region_rehash_interval" devlink param")
Fixes: 7c62cfb8c574 ("devlink: publish params only after driver init is done")
Signed-off-by: Jiri Pirko <>
Signed-off-by: Ido Schimmel <>
Signed-off-by: David S. Miller <>
Signed-off-by: Paul Gortmaker <>
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 6ee6de7f0160..09eb0b56a50f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -1113,7 +1113,7 @@ __mlxsw_core_bus_device_register(const struct mlxsw_bus_info *mlxsw_bus_info,
goto err_driver_init;
- if (mlxsw_driver->params_register && !reload)
+ if (mlxsw_driver->params_register)
return 0;
@@ -1185,7 +1185,7 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
- if (mlxsw_core->driver->params_unregister && !reload)
+ if (mlxsw_core->driver->params_unregister)
if (mlxsw_core->driver->fini)