lkml.org 
[lkml]   [2020]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 35/56] mlxsw: core: Increase scope of RCU read-side critical section
    Date
    From: Ido Schimmel <idosch@mellanox.com>

    [ Upstream commit 7d8e8f3433dc8d1dc87c1aabe73a154978fb4c4d ]

    The lifetime of the Rx listener item ('rxl_item') is managed using RCU,
    but is dereferenced outside of RCU read-side critical section, which can
    lead to a use-after-free.

    Fix this by increasing the scope of the RCU read-side critical section.

    Fixes: 93c1edb27f9e ("mlxsw: Introduce Mellanox switch driver core")
    Signed-off-by: Ido Schimmel <idosch@mellanox.com>
    Reviewed-by: Jiri Pirko <jiri@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/mellanox/mlxsw/core.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
    index e180ec4f1a248..3cebea6f3e6ad 100644
    --- a/drivers/net/ethernet/mellanox/mlxsw/core.c
    +++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
    @@ -1605,11 +1605,13 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb,
    break;
    }
    }
    - rcu_read_unlock();
    - if (!found)
    + if (!found) {
    + rcu_read_unlock();
    goto drop;
    + }

    rxl->func(skb, local_port, rxl_item->priv);
    + rcu_read_unlock();
    return;

    drop:
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-03 14:33    [W:4.657 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site