Commit 1195c7ce authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'mlxsw-Various-fixes' 



Ido Schimmel says:

====================
mlxsw: Various fixes

Fix two issues found by syzkaller.

Patch #1 removes inappropriate usage of WARN_ON() following memory
allocation failure. Constantly triggered when syzkaller injects faults.

Patch #2 fixes a use-after-free that can be triggered by 'devlink dev
info' following a failed devlink reload.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f9f41e3d c4317b11

drivers/net/ethernet/mellanox/mlxsw/pci.c

+38 −16
Original line number Diff line number Diff line
@@ -1414,23 +1414,12 @@ static int mlxsw_pci_init(void *bus_priv, struct mlxsw_core *mlxsw_core, 
	u16 num_pages;

	int err;



	mutex_init(&mlxsw_pci->cmd.lock);

	init_waitqueue_head(&mlxsw_pci->cmd.wait);



	mlxsw_pci->core = mlxsw_core;



	mbox = mlxsw_cmd_mbox_alloc();

	if (!mbox)

		return -ENOMEM;



	err = mlxsw_pci_mbox_alloc(mlxsw_pci, &mlxsw_pci->cmd.in_mbox);

	if (err)

		goto mbox_put;



	err = mlxsw_pci_mbox_alloc(mlxsw_pci, &mlxsw_pci->cmd.out_mbox);

	if (err)

		goto err_out_mbox_alloc;



	err = mlxsw_pci_sw_reset(mlxsw_pci, mlxsw_pci->id);

	if (err)

		goto err_sw_reset;
@@ -1537,9 +1526,6 @@ err_query_fw: 
	mlxsw_pci_free_irq_vectors(mlxsw_pci);

err_alloc_irq:

err_sw_reset:

	mlxsw_pci_mbox_free(mlxsw_pci, &mlxsw_pci->cmd.out_mbox);

err_out_mbox_alloc:

	mlxsw_pci_mbox_free(mlxsw_pci, &mlxsw_pci->cmd.in_mbox);

mbox_put:

	mlxsw_cmd_mbox_free(mbox);

	return err;
@@ -1553,8 +1539,6 @@ static void mlxsw_pci_fini(void *bus_priv) 
	mlxsw_pci_aqs_fini(mlxsw_pci);

	mlxsw_pci_fw_area_fini(mlxsw_pci);

	mlxsw_pci_free_irq_vectors(mlxsw_pci);

	mlxsw_pci_mbox_free(mlxsw_pci, &mlxsw_pci->cmd.out_mbox);

	mlxsw_pci_mbox_free(mlxsw_pci, &mlxsw_pci->cmd.in_mbox);

}



static struct mlxsw_pci_queue *
@@ -1776,6 +1760,37 @@ static const struct mlxsw_bus mlxsw_pci_bus = { 
	.features		= MLXSW_BUS_F_TXRX | MLXSW_BUS_F_RESET,

};



static int mlxsw_pci_cmd_init(struct mlxsw_pci *mlxsw_pci)

{

	int err;



	mutex_init(&mlxsw_pci->cmd.lock);

	init_waitqueue_head(&mlxsw_pci->cmd.wait);



	err = mlxsw_pci_mbox_alloc(mlxsw_pci, &mlxsw_pci->cmd.in_mbox);

	if (err)

		goto err_in_mbox_alloc;



	err = mlxsw_pci_mbox_alloc(mlxsw_pci, &mlxsw_pci->cmd.out_mbox);

	if (err)

		goto err_out_mbox_alloc;



	return 0;



err_out_mbox_alloc:

	mlxsw_pci_mbox_free(mlxsw_pci, &mlxsw_pci->cmd.in_mbox);

err_in_mbox_alloc:

	mutex_destroy(&mlxsw_pci->cmd.lock);

	return err;

}



static void mlxsw_pci_cmd_fini(struct mlxsw_pci *mlxsw_pci)

{

	mlxsw_pci_mbox_free(mlxsw_pci, &mlxsw_pci->cmd.out_mbox);

	mlxsw_pci_mbox_free(mlxsw_pci, &mlxsw_pci->cmd.in_mbox);

	mutex_destroy(&mlxsw_pci->cmd.lock);

}



static int mlxsw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)

{

	const char *driver_name = pdev->driver->name;
@@ -1831,6 +1846,10 @@ static int mlxsw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) 
	mlxsw_pci->pdev = pdev;

	pci_set_drvdata(pdev, mlxsw_pci);



	err = mlxsw_pci_cmd_init(mlxsw_pci);

	if (err)

		goto err_pci_cmd_init;



	mlxsw_pci->bus_info.device_kind = driver_name;

	mlxsw_pci->bus_info.device_name = pci_name(mlxsw_pci->pdev);

	mlxsw_pci->bus_info.dev = &pdev->dev;
@@ -1848,6 +1867,8 @@ static int mlxsw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) 
	return 0;



err_bus_device_register:

	mlxsw_pci_cmd_fini(mlxsw_pci);

err_pci_cmd_init:

	iounmap(mlxsw_pci->hw_addr);

err_ioremap:

err_pci_resource_len_check:
@@ -1865,6 +1886,7 @@ static void mlxsw_pci_remove(struct pci_dev *pdev) 
	struct mlxsw_pci *mlxsw_pci = pci_get_drvdata(pdev);



	mlxsw_core_bus_device_unregister(mlxsw_pci->core, false);

	mlxsw_pci_cmd_fini(mlxsw_pci);

	iounmap(mlxsw_pci->hw_addr);

	pci_release_regions(mlxsw_pci->pdev);

	pci_disable_device(mlxsw_pci->pdev);

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c

+1 −1
Original line number Diff line number Diff line
@@ -6262,7 +6262,7 @@ static int mlxsw_sp_router_fib_event(struct notifier_block *nb, 
	}



	fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC);

	if (WARN_ON(!fib_work))

	if (!fib_work)

		return NOTIFY_BAD;



	fib_work->mlxsw_sp = router->mlxsw_sp;

CRA Git | Maintained and supported by SUSTech CRA and CCSE