diff options
| author | Vladimir Oltean <vladimir.oltean@nxp.com> | 2022-02-15 01:42:00 +0200 |
|---|---|---|
| committer | Vladimir Oltean <vladimir.oltean@nxp.com> | 2022-05-04 15:24:53 +0200 |
| commit | 290231d5e5db2ccd51fcf88d43f6d8027c5ca977 (patch) | |
| tree | ac54616ed70df4b1d4da36e305c895bc97a0968b /drivers/net/ethernet | |
| parent | 9085b0a86b10df6b2cde3620c3218251ba5b0b24 (diff) | |
net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
this is the same as the port's pvid_vlan which we access afterwards,
what we're accessing is freed memory.
Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
to calling ocelot_vlan_member_del().
Fixes: d4004422f6f9 ("net: mscc: ocelot: track the port pvid using a pointer")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ef57640575406f57f5b3393cf57f457b0ace837e)
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Diffstat (limited to 'drivers/net/ethernet')
| -rw-r--r-- | drivers/net/ethernet/mscc/ocelot.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c index c4dd08b14e77..398efbcac4fd 100644 --- a/drivers/net/ethernet/mscc/ocelot.c +++ b/drivers/net/ethernet/mscc/ocelot.c @@ -549,14 +549,18 @@ EXPORT_SYMBOL(ocelot_vlan_add); int ocelot_vlan_del(struct ocelot *ocelot, int port, u16 vid) { struct ocelot_port *ocelot_port = ocelot->ports[port]; + bool del_pvid = false; int err; + if (ocelot_port->pvid_vlan && ocelot_port->pvid_vlan->vid == vid) + del_pvid = true; + err = ocelot_vlan_member_del(ocelot, port, vid); if (err) return err; /* Ingress */ - if (ocelot_port->pvid_vlan && ocelot_port->pvid_vlan->vid == vid) + if (del_pvid) ocelot_port_set_pvid(ocelot, port, NULL); /* Egress */ |