From patchwork Tue Feb 13 10:22:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Pirko X-Patchwork-Id: 872745 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=resnulli-us.20150623.gappssmtp.com header.i=@resnulli-us.20150623.gappssmtp.com header.b="nZwTuu9S"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zgds666fdz9s72 for ; Tue, 13 Feb 2018 21:22:50 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934086AbeBMKWr (ORCPT ); Tue, 13 Feb 2018 05:22:47 -0500 Received: from mail-wm0-f65.google.com ([74.125.82.65]:53991 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933825AbeBMKWp (ORCPT ); Tue, 13 Feb 2018 05:22:45 -0500 Received: by mail-wm0-f65.google.com with SMTP id t74so15031173wme.3 for ; Tue, 13 Feb 2018 02:22:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=resnulli-us.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=nDHnE0Uwg/nBs7rZAPe78lomLUSEi6cQ3hAgt/qf3Mg=; b=nZwTuu9SroKt/GRm6TT+r0D8IU1e+saWnf/P9aYWj7+yp26sS6iCWIBBRjjJxOYvjZ oVEOXpydfbitN6Dzr/Gvq9NhkKkzyLsd20cUdHbHIRNL2rbDpC32guD2ur4wpZX1wdlx zx48MHKa8QSBNuPOA1gKieYTpEIr6GkVnHa1f1SwJIQqHZdfVHiWopEyx9EhHNf8XB3b 3R9+1qtgezdsx34mtG4/+Ki6I8nI8cHiVCZc9MmY7as3tIhvwtTeNypQasTmqwmKQrn3 LTXGH+TOrDdBsjgrEn7Hb5uZTCfVacz7DUekPFew57Pq4ij1Q8twRlKeZBDKd9y1foZK bSkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=nDHnE0Uwg/nBs7rZAPe78lomLUSEi6cQ3hAgt/qf3Mg=; b=UZlsP/nN52E6+bSSn2H7BogyjwrHgXz/Wu+dPoa9iwBL9w1hLTfll+YQPjGUxrKiOM +F88ZERpFXKOHjJkFEje8/Kh90LWdSz7xOt+5PQVoV7DhrH0HkGD6vgVv63WVV+R/2rc c+P8pw/TYGeSmlC7Pt9NRu8VHihJMv7wIcTeMvM14OuiOZ9tFNLcVM0uCdVzsXpe0ey1 NdO5K/xiGs2mlq8WfT/2LLSE2e2OV7oFa+zOct7S37p2LCEloDOCcQ6fWe4vQ6Ex4V/O bsNEHQ3l9sjWEm8WuvdDBXGVnBX3msI2P6BHJkIuOr1t9epn3hytz7GtlYoJ1rlH3YKI qKWw== X-Gm-Message-State: APf1xPBRjJ9CQ14F0oVRCotxmkj6U+R65AYW4v6M2vYkRrxmPEUMuEvs sdANJaBv0aWHT/1blz+WBQOx+hOU X-Google-Smtp-Source: AH8x227EOwjneTDPZB9u9u6HMcJZbEaPQ8GDJRHFV7Xudk6xkrZtUcffRFII8XzA+j8XKnv/iaOICw== X-Received: by 10.28.59.214 with SMTP id i205mr802469wma.18.1518517363672; Tue, 13 Feb 2018 02:22:43 -0800 (PST) Received: from localhost (jirka.pirko.cz. [84.16.102.26]) by smtp.gmail.com with ESMTPSA id i75sm6468823wmg.41.2018.02.13.02.22.43 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 13 Feb 2018 02:22:43 -0800 (PST) From: Jiri Pirko To: netdev@vger.kernel.org Cc: davem@davemloft.net, idosch@mellanox.com, mlxsw@mellanox.com Subject: [patch net] mlxsw: spectrum_router: Fix error path in mlxsw_sp_vr_create Date: Tue, 13 Feb 2018 11:22:42 +0100 Message-Id: <20180213102242.7576-1-jiri@resnulli.us> X-Mailer: git-send-email 2.14.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Jiri Pirko Since mlxsw_sp_fib_create() and mlxsw_sp_mr_table_create() use ERR_PTR macro to propagate int err through return of a pointer, the return value is not NULL in case of failure. So if one of the calls fails, one of vr->fib4, vr->fib6 or vr->mr4_table is not NULL and mlxsw_sp_vr_is_used wrongly assumes that vr is in use which leads to crash like following one: [ 1293.949291] BUG: unable to handle kernel NULL pointer dereference at 00000000000006c9 [ 1293.952729] IP: mlxsw_sp_mr_table_flush+0x15/0x70 [mlxsw_spectrum] Fix this by using local variables to hold the pointers and set vr->* only in case everything went fine. Fixes: 76610ebbde18 ("mlxsw: spectrum_router: Refactor virtual router handling") Fixes: a3d9bc506d64 ("mlxsw: spectrum_router: Extend virtual routers with IPv6 support") Fixes: d42b0965b1d4 ("mlxsw: spectrum_router: Add multicast routes notification handling functionality") Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: Jiri Pirko --- .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 32 ++++++++++++---------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c index f0b25baba09a..dcc6305f7c22 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c @@ -788,6 +788,9 @@ static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp, u32 tb_id, struct netlink_ext_ack *extack) { + struct mlxsw_sp_mr_table *mr4_table; + struct mlxsw_sp_fib *fib4; + struct mlxsw_sp_fib *fib6; struct mlxsw_sp_vr *vr; int err; @@ -796,29 +799,30 @@ static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp, NL_SET_ERR_MSG(extack, "spectrum: Exceeded number of supported virtual routers"); return ERR_PTR(-EBUSY); } - vr->fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4); - if (IS_ERR(vr->fib4)) - return ERR_CAST(vr->fib4); - vr->fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6); - if (IS_ERR(vr->fib6)) { - err = PTR_ERR(vr->fib6); + fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4); + if (IS_ERR(fib4)) + return ERR_CAST(fib4); + fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6); + if (IS_ERR(fib6)) { + err = PTR_ERR(fib6); goto err_fib6_create; } - vr->mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id, - MLXSW_SP_L3_PROTO_IPV4); - if (IS_ERR(vr->mr4_table)) { - err = PTR_ERR(vr->mr4_table); + mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id, + MLXSW_SP_L3_PROTO_IPV4); + if (IS_ERR(mr4_table)) { + err = PTR_ERR(mr4_table); goto err_mr_table_create; } + vr->fib4 = fib4; + vr->fib6 = fib6; + vr->mr4_table = mr4_table; vr->tb_id = tb_id; return vr; err_mr_table_create: - mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib6); - vr->fib6 = NULL; + mlxsw_sp_fib_destroy(mlxsw_sp, fib6); err_fib6_create: - mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib4); - vr->fib4 = NULL; + mlxsw_sp_fib_destroy(mlxsw_sp, fib4); return ERR_PTR(err); }