| From e01ff2d350c69f0a29944fae29e8916e24a29522 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 10 Dec 2019 10:20:32 -0800 |
| Subject: Revert "nfp: abm: fix memory leak in nfp_abm_u32_knode_replace" |
| |
| From: Jakub Kicinski <jakub.kicinski@netronome.com> |
| |
| [ Upstream commit 1d1997db870f4058676439ef7014390ba9e24eb2 ] |
| |
| This reverts commit 78beef629fd9 ("nfp: abm: fix memory leak in |
| nfp_abm_u32_knode_replace"). |
| |
| The quoted commit does not fix anything and resulted in a bogus |
| CVE-2019-19076. |
| |
| If match is NULL then it is known there is no matching entry in |
| list, hence, calling nfp_abm_u32_knode_delete() is pointless. |
| |
| Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> |
| Reviewed-by: John Hurley <john.hurley@netronome.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/netronome/nfp/abm/cls.c | 14 ++++---------- |
| 1 file changed, 4 insertions(+), 10 deletions(-) |
| |
| diff --git a/drivers/net/ethernet/netronome/nfp/abm/cls.c b/drivers/net/ethernet/netronome/nfp/abm/cls.c |
| index 9f8a1f69c0c4c..23ebddfb95325 100644 |
| --- a/drivers/net/ethernet/netronome/nfp/abm/cls.c |
| +++ b/drivers/net/ethernet/netronome/nfp/abm/cls.c |
| @@ -176,10 +176,8 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink, |
| u8 mask, val; |
| int err; |
| |
| - if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack)) { |
| - err = -EOPNOTSUPP; |
| + if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack)) |
| goto err_delete; |
| - } |
| |
| tos_off = proto == htons(ETH_P_IP) ? 16 : 20; |
| |
| @@ -200,18 +198,14 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink, |
| if ((iter->val & cmask) == (val & cmask) && |
| iter->band != knode->res->classid) { |
| NL_SET_ERR_MSG_MOD(extack, "conflict with already offloaded filter"); |
| - err = -EOPNOTSUPP; |
| goto err_delete; |
| } |
| } |
| |
| if (!match) { |
| match = kzalloc(sizeof(*match), GFP_KERNEL); |
| - if (!match) { |
| - err = -ENOMEM; |
| - goto err_delete; |
| - } |
| - |
| + if (!match) |
| + return -ENOMEM; |
| list_add(&match->list, &alink->dscp_map); |
| } |
| match->handle = knode->handle; |
| @@ -227,7 +221,7 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink, |
| |
| err_delete: |
| nfp_abm_u32_knode_delete(alink, knode); |
| - return err; |
| + return -EOPNOTSUPP; |
| } |
| |
| static int nfp_abm_setup_tc_block_cb(enum tc_setup_type type, |
| -- |
| 2.20.1 |
| |