Re: [PATCH iwl-next v3 03/10] ice: Implement basic eswitch bridge setup

[Simon Horman <simon.horman@corigine.com>]

+Dan Carpenter

On Mon, May 22, 2023 at 11:05:35AM +0200, Wojciech Drewek wrote:
> With this patch, ice driver is able to track if the port
> representors or uplink port were added to the linux bridge in
> switchdev mode. Listen for NETDEV_CHANGEUPPER events in order to
> detect this. ice_esw_br data structure reflects the linux bridge
> and stores all the ports of the bridge (ice_esw_br_port) in
> xarray, it's created when the first port is added to the bridge and
> freed once the last port is removed. Note that only one bridge is
> supported per eswitch.
> 
> Bridge port (ice_esw_br_port) can be either a VF port representor
> port or uplink port (ice_esw_br_port_type). In both cases bridge port
> holds a reference to the VSI, VF's VSI in case of the PR and uplink
> VSI in case of the uplink. VSI's index is used as an index to the
> xarray in which ports are stored.
> 
> Add a check which prevents configuring switchdev mode if uplink is
> already added to any bridge. This is needed because we need to listen
> for NETDEV_CHANGEUPPER events to record if the uplink was added to
> the bridge. Netdevice notifier is registered after eswitch mode
> is changed top switchdev.
> 
> Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com>

...

> +static void
> +ice_eswitch_br_port_deinit(struct ice_esw_br *bridge,
> +			   struct ice_esw_br_port *br_port)
> +{
> +	struct ice_vsi *vsi = br_port->vsi;
> +
> +	if (br_port->type == ICE_ESWITCH_BR_UPLINK_PORT && vsi->back)
> +		vsi->back->br_port = NULL;
> +	else if (vsi->vf)
> +		vsi->vf->repr->br_port = NULL;
> +
> +	xa_erase(&bridge->ports, br_port->vsi_idx);
> +	kfree(br_port);
> +}

...

> +static int
> +ice_eswitch_br_port_unlink(struct ice_esw_br_offloads *br_offloads,
> +			   struct net_device *dev, int ifindex,
> +			   struct netlink_ext_ack *extack)
> +{
> +	struct ice_esw_br_port *br_port = ice_eswitch_br_netdev_to_port(dev);
> +
> +	if (!br_port) {
> +		NL_SET_ERR_MSG_MOD(extack,
> +				   "Port representor is not attached to any bridge");
> +		return -EINVAL;
> +	}
> +
> +	if (br_port->bridge->ifindex != ifindex) {
> +		NL_SET_ERR_MSG_MOD(extack,
> +				   "Port representor is attached to another bridge");
> +		return -EINVAL;
> +	}
> +
> +	ice_eswitch_br_port_deinit(br_port->bridge, br_port);

Hi Wojciech,

According to Smatch, ice_eswitch_br_port_deinit() will free br_port.

> +	ice_eswitch_br_verify_deinit(br_offloads, br_port->bridge);

But br_port is dereferenced here.

.../ice_eswitch_br.c:207 ice_eswitch_br_port_unlink() error: dereferencing freed memory 'br_port'

> +
> +	return 0;
> +}

...

--
pw-bot: cr