Re: [PATCH net] net/mlx5e: Cleanup MACsec uninitialization routine

[Tariq Toukan <ttoukan.linux@gmail.com>]

On 10/13/2022 10:21 AM, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
> 
> The mlx5e_macsec_cleanup() routine has pointer dereferencing if mlx5 device
> doesn't support MACsec (priv->macsec will be NULL) together with useless
> comment line, assignment and extra blank lines.
> 
> Fix everything in one patch.
> 
> Fixes: 1f53da676439 ("net/mlx5e: Create advanced steering operation (ASO) object for MACsec")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
>   .../net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 11 +----------
>   1 file changed, 1 insertion(+), 10 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
> index 41970067917b..4331235b21ee 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
> @@ -1846,25 +1846,16 @@ int mlx5e_macsec_init(struct mlx5e_priv *priv)
>   void mlx5e_macsec_cleanup(struct mlx5e_priv *priv)
>   {
>   	struct mlx5e_macsec *macsec = priv->macsec;
> -	struct mlx5_core_dev *mdev = macsec->mdev;
> +	struct mlx5_core_dev *mdev = priv->mdev;
>   

simply defer the mdev calculation to be after the early return, trying 
to keep this macsec function as independent as possible.

>   	if (!macsec)
>   		return;
>   
>   	mlx5_notifier_unregister(mdev, &macsec->nb);
> -
>   	mlx5e_macsec_fs_cleanup(macsec->macsec_fs);
> -
> -	/* Cleanup workqueue */
>   	destroy_workqueue(macsec->wq);
> -
>   	mlx5e_macsec_aso_cleanup(&macsec->aso, mdev);
> -
> -	priv->macsec = NULL;
> -

Why remove this assignment?

It protects against accessing freed memory, for instance when querying 
the macsec stats, see 
drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_stats.c

>   	rhashtable_destroy(&macsec->sci_hash);
> -
>   	mutex_destroy(&macsec->lock);
> -
>   	kfree(macsec);
>   }