Commit dca59f4a authored by Dima Chumak's avatar Dima Chumak Committed by Saeed Mahameed
Browse files

net/mlx5e: Fix nullptr in add_vlan_push_action() 



The result of dev_get_by_index_rcu() is not checked for NULL and then
gets dereferenced immediately.

Also, the RCU lock must be held by the caller of dev_get_by_index_rcu(),
which isn't satisfied by the call stack.

Fix by handling nullptr return value when iflink device is not found.
Add RCU locking around dev_get_by_index_rcu() to avoid possible adverse
effects while iterating over the net_device's hlist.

It is safe not to increment reference count of the net_device pointer in
case of a successful lookup, because it's already handled by VLAN code
during VLAN device registration (see register_vlan_dev and
netdev_upper_dev_link).

Fixes: 278748a9 ("net/mlx5e: Offload TC e-switch rules with egress VLAN device")
Addresses-Coverity: ("Dereference null return value")
Signed-off-by: default avatarDima Chumak <dchumak@nvidia.com>
Reviewed-by: default avatarVlad Buslov <vladbu@nvidia.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent 3410fbcd

drivers/net/ethernet/mellanox/mlx5/core/en_tc.c

+6 −2
Original line number Original line Diff line number Diff line
@@ -3526,8 +3526,12 @@ static int add_vlan_push_action(struct mlx5e_priv *priv, 
	if (err)

	if (err)

		return err;

		return err;





	*out_dev = dev_get_by_index_rcu(dev_net(vlan_dev),

	rcu_read_lock();

					dev_get_iflink(vlan_dev));

	*out_dev = dev_get_by_index_rcu(dev_net(vlan_dev), dev_get_iflink(vlan_dev));

	rcu_read_unlock();

	if (!*out_dev)

		return -ENODEV;



	if (is_vlan_dev(*out_dev))

	if (is_vlan_dev(*out_dev))

		err = add_vlan_push_action(priv, attr, out_dev, action);

		err = add_vlan_push_action(priv, attr, out_dev, action);