[PATCH net] net: marvell: prestera: fix double free issue on err path

[PATCH net] net: marvell: prestera: fix double free issue on err path

[Volodymyr Mytnyk]

From: Volodymyr Mytnyk <vmytnyk@marvell.com>

fix error path handling in prestera_bridge_port_join() that
cases prestera driver to crash (see below).

 Trace:
   Internal error: Oops: 96000044 [#1] SMP
   Modules linked in: prestera_pci prestera uio_pdrv_genirq
   CPU: 1 PID: 881 Comm: ip Not tainted 5.15.0 #1
   pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
   pc : prestera_bridge_destroy+0x2c/0xb0 [prestera]
   lr : prestera_bridge_port_join+0x2cc/0x350 [prestera]
   sp : ffff800011a1b0f0
   ...
   x2 : ffff000109ca6c80 x1 : dead000000000100 x0 : dead000000000122
    Call trace:
   prestera_bridge_destroy+0x2c/0xb0 [prestera]
   prestera_bridge_port_join+0x2cc/0x350 [prestera]
   prestera_netdev_port_event.constprop.0+0x3c4/0x450 [prestera]
   prestera_netdev_event_handler+0xf4/0x110 [prestera]
   raw_notifier_call_chain+0x54/0x80
   call_netdevice_notifiers_info+0x54/0xa0
   __netdev_upper_dev_link+0x19c/0x380

Fixes: e1189d9a5fbe ("net: marvell: prestera: Add Switchdev driver implementation")
Signed-off-by: Volodymyr Mytnyk <vmytnyk@marvell.com>
---
 drivers/net/ethernet/marvell/prestera/prestera_switchdev.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
index 79f2fca0d412..b4599fe4ca8d 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_switchdev.c
@@ -497,8 +497,8 @@ int prestera_bridge_port_join(struct net_device *br_dev,
 
 	br_port = prestera_bridge_port_add(bridge, port->dev);
 	if (IS_ERR(br_port)) {
-		err = PTR_ERR(br_port);
-		goto err_brport_create;
+		prestera_bridge_put(bridge);
+		return PTR_ERR(br_port);
 	}
 
 	err = switchdev_bridge_port_offload(br_port->dev, port->dev, NULL,
@@ -519,8 +519,6 @@ int prestera_bridge_port_join(struct net_device *br_dev,
 	switchdev_bridge_port_unoffload(br_port->dev, NULL, NULL, NULL);
 err_switchdev_offload:
 	prestera_bridge_port_put(br_port);
-err_brport_create:
-	prestera_bridge_put(bridge);
 	return err;
 }
 
-- 
2.7.4

Re: [PATCH net] net: marvell: prestera: fix double free issue on err path

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Thu, 18 Nov 2021 21:51:40 +0200 you wrote:
> From: Volodymyr Mytnyk <vmytnyk@marvell.com>
> 
> fix error path handling in prestera_bridge_port_join() that
> cases prestera driver to crash (see below).
> 
>  Trace:
>    Internal error: Oops: 96000044 [#1] SMP
>    Modules linked in: prestera_pci prestera uio_pdrv_genirq
>    CPU: 1 PID: 881 Comm: ip Not tainted 5.15.0 #1
>    pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>    pc : prestera_bridge_destroy+0x2c/0xb0 [prestera]
>    lr : prestera_bridge_port_join+0x2cc/0x350 [prestera]
>    sp : ffff800011a1b0f0
>    ...
>    x2 : ffff000109ca6c80 x1 : dead000000000100 x0 : dead000000000122
>     Call trace:
>    prestera_bridge_destroy+0x2c/0xb0 [prestera]
>    prestera_bridge_port_join+0x2cc/0x350 [prestera]
>    prestera_netdev_port_event.constprop.0+0x3c4/0x450 [prestera]
>    prestera_netdev_event_handler+0xf4/0x110 [prestera]
>    raw_notifier_call_chain+0x54/0x80
>    call_netdevice_notifiers_info+0x54/0xa0
>    __netdev_upper_dev_link+0x19c/0x380
> 
> [...]

Here is the summary with links:
  - [net] net: marvell: prestera: fix double free issue on err path
    https://git.kernel.org/netdev/net/c/e8d032507cb7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html