| From c66d511754f9e63ee5d4d5821c643bea47c6afa9 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 29 Jul 2020 12:26:45 +0300 |
| Subject: mlxsw: core: Increase scope of RCU read-side critical section |
| |
| From: Ido Schimmel <idosch@mellanox.com> |
| |
| [ Upstream commit 7d8e8f3433dc8d1dc87c1aabe73a154978fb4c4d ] |
| |
| The lifetime of the Rx listener item ('rxl_item') is managed using RCU, |
| but is dereferenced outside of RCU read-side critical section, which can |
| lead to a use-after-free. |
| |
| Fix this by increasing the scope of the RCU read-side critical section. |
| |
| Fixes: 93c1edb27f9e ("mlxsw: Introduce Mellanox switch driver core") |
| Signed-off-by: Ido Schimmel <idosch@mellanox.com> |
| Reviewed-by: Jiri Pirko <jiri@mellanox.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/mellanox/mlxsw/core.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c |
| index e180ec4f1a248..3cebea6f3e6ad 100644 |
| --- a/drivers/net/ethernet/mellanox/mlxsw/core.c |
| +++ b/drivers/net/ethernet/mellanox/mlxsw/core.c |
| @@ -1605,11 +1605,13 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb, |
| break; |
| } |
| } |
| - rcu_read_unlock(); |
| - if (!found) |
| + if (!found) { |
| + rcu_read_unlock(); |
| goto drop; |
| + } |
| |
| rxl->func(skb, local_port, rxl_item->priv); |
| + rcu_read_unlock(); |
| return; |
| |
| drop: |
| -- |
| 2.25.1 |
| |
