| Message ID | 20210322202650.45776-1-george.mccollister@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [net] net: dsa: don't assign an error value to tag_ops | expand |
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Mon, 22 Mar 2021 15:26:50 -0500 you wrote: > Use a temporary variable to hold the return value from > dsa_tag_driver_get() instead of assigning it to dst->tag_ops. Leaving > an error value in dst->tag_ops can result in deferencing an invalid > pointer when a deferred switch configuration happens later. > > Fixes: 357f203bb3b5 ("net: dsa: keep a copy of the tagging protocol in the DSA switch tree") > > [...] Here is the summary with links: - [net] net: dsa: don't assign an error value to tag_ops https://git.kernel.org/netdev/net/c/e0c755a45f6f You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c index eb709d988c54..8f9e35e1aa89 100644 --- a/net/dsa/dsa2.c +++ b/net/dsa/dsa2.c @@ -1068,6 +1068,7 @@ static int dsa_port_parse_cpu(struct dsa_port *dp, struct net_device *master) { struct dsa_switch *ds = dp->ds; struct dsa_switch_tree *dst = ds->dst; + const struct dsa_device_ops *tag_ops; enum dsa_tag_protocol tag_protocol; tag_protocol = dsa_get_tag_protocol(dp, master); @@ -1082,14 +1083,16 @@ static int dsa_port_parse_cpu(struct dsa_port *dp, struct net_device *master) * nothing to do here. */ } else { - dst->tag_ops = dsa_tag_driver_get(tag_protocol); - if (IS_ERR(dst->tag_ops)) { - if (PTR_ERR(dst->tag_ops) == -ENOPROTOOPT) + tag_ops = dsa_tag_driver_get(tag_protocol); + if (IS_ERR(tag_ops)) { + if (PTR_ERR(tag_ops) == -ENOPROTOOPT) return -EPROBE_DEFER; dev_warn(ds->dev, "No tagger for this switch\n"); dp->master = NULL; - return PTR_ERR(dst->tag_ops); + return PTR_ERR(tag_ops); } + + dst->tag_ops = tag_ops; } dp->master = master;
Use a temporary variable to hold the return value from dsa_tag_driver_get() instead of assigning it to dst->tag_ops. Leaving an error value in dst->tag_ops can result in deferencing an invalid pointer when a deferred switch configuration happens later. Fixes: 357f203bb3b5 ("net: dsa: keep a copy of the tagging protocol in the DSA switch tree") Signed-off-by: George McCollister <george.mccollister@gmail.com> --- net/dsa/dsa2.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)