[PATCH net] net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()

[PATCH net] net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()

[Vladimir Oltean]

ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
this is the same as the port's pvid_vlan which we access afterwards,
what we're accessing is freed memory.

Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
to calling ocelot_vlan_member_del().

Fixes: d4004422f6f9 ("net: mscc: ocelot: track the port pvid using a pointer")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
---
 drivers/net/ethernet/mscc/ocelot.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index e6de86552df0..fd3ceb74620d 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -549,14 +549,18 @@ EXPORT_SYMBOL(ocelot_vlan_add);
 int ocelot_vlan_del(struct ocelot *ocelot, int port, u16 vid)
 {
 	struct ocelot_port *ocelot_port = ocelot->ports[port];
+	bool del_pvid = false;
 	int err;
 
+	if (ocelot_port->pvid_vlan && ocelot_port->pvid_vlan->vid == vid)
+		del_pvid = true;
+
 	err = ocelot_vlan_member_del(ocelot, port, vid);
 	if (err)
 		return err;
 
 	/* Ingress */
-	if (ocelot_port->pvid_vlan && ocelot_port->pvid_vlan->vid == vid)
+	if (del_pvid)
 		ocelot_port_set_pvid(ocelot, port, NULL);
 
 	/* Egress */
-- 
2.25.1

Re: [PATCH net] net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Tue, 15 Feb 2022 01:42:00 +0200 you wrote:
> ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
> this is the same as the port's pvid_vlan which we access afterwards,
> what we're accessing is freed memory.
> 
> Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
> to calling ocelot_vlan_member_del().
> 
> [...]

Here is the summary with links:
  - [net] net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
    https://git.kernel.org/netdev/net/c/ef5764057540

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html