2022-11-19 18:04:08 +00:00
|
|
|
From: Felix Fietkau <nbd@nbd.name>
|
2023-03-20 17:06:23 +00:00
|
|
|
Date: Mon, 20 Mar 2023 15:49:15 +0100
|
2022-11-19 18:04:08 +00:00
|
|
|
Subject: [PATCH] net: ethernet: mtk_eth_soc: fix flow_offload related refcount
|
|
|
|
|
bug
|
|
|
|
|
|
|
|
|
|
Since we call flow_block_cb_decref on FLOW_BLOCK_UNBIND, we need to call
|
|
|
|
|
flow_block_cb_incref unconditionally, even for a newly allocated cb.
|
2023-03-20 17:06:23 +00:00
|
|
|
Fixes a use-after-free bug. Also fix the accidentally inverted refcount
|
|
|
|
|
check on unbind.
|
2022-11-19 18:04:08 +00:00
|
|
|
|
|
|
|
|
Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support")
|
|
|
|
|
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
|
|
|
|
|
+++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
|
2023-03-23 09:08:51 +00:00
|
|
|
@@ -583,6 +583,7 @@ mtk_eth_setup_tc_block(struct net_device
|
|
|
|
|
if (IS_ERR(block_cb))
|
|
|
|
|
return PTR_ERR(block_cb);
|
2022-11-19 18:04:08 +00:00
|
|
|
|
|
|
|
|
+ flow_block_cb_incref(block_cb);
|
2023-03-23 09:08:51 +00:00
|
|
|
flow_block_cb_add(block_cb, f);
|
|
|
|
|
list_add_tail(&block_cb->driver_list, &block_cb_list);
|
2022-11-19 18:04:08 +00:00
|
|
|
return 0;
|
2023-03-23 09:08:51 +00:00
|
|
|
@@ -591,7 +592,7 @@ mtk_eth_setup_tc_block(struct net_device
|
2023-03-20 17:06:23 +00:00
|
|
|
if (!block_cb)
|
|
|
|
|
return -ENOENT;
|
|
|
|
|
|
|
|
|
|
- if (flow_block_cb_decref(block_cb)) {
|
|
|
|
|
+ if (!flow_block_cb_decref(block_cb)) {
|
|
|
|
|
flow_block_cb_remove(block_cb, f);
|
|
|
|
|
list_del(&block_cb->driver_list);
|
|
|
|
|
}
|
