All of lore.kernel.org
 help / color / mirror / Atom feed
From: Vladimir Oltean <vladimir.oltean@nxp.com>
To: netdev@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>,
	"Jakub Kicinski" <kuba@kernel.org>,
	"Florian Fainelli" <f.fainelli@gmail.com>,
	"Andrew Lunn" <andrew@lunn.ch>,
	"Vivien Didelot" <vivien.didelot@gmail.com>,
	"Vladimir Oltean" <olteanv@gmail.com>,
	UNGLinuxDriver@microchip.com, "DENG Qingfang" <dqfext@gmail.com>,
	"Kurt Kanzenbach" <kurt@linutronix.de>,
	"Hauke Mehrtens" <hauke@hauke-m.de>,
	"Woojung Huh" <woojung.huh@microchip.com>,
	"Sean Wang" <sean.wang@mediatek.com>,
	"Landen Chao" <Landen.Chao@mediatek.com>,
	"Alexandre Belloni" <alexandre.belloni@bootlin.com>,
	"George McCollister" <george.mccollister@gmail.com>,
	"John Crispin" <john@phrozen.org>,
	"Aleksander Jan Bajkowski" <olek2@wp.pl>,
	"Egil Hjelmeland" <privat@egil-hjelmeland.no>,
	"Oleksij Rempel" <o.rempel@pengutronix.de>,
	"Prasanna Vengateshan" <prasanna.vengateshan@microchip.com>,
	"Ansuel Smith" <ansuelsmth@gmail.com>,
	"Alvin Šipraga" <alsi@bang-olufsen.dk>,
	"Claudiu Manoil" <claudiu.manoil@nxp.com>
Subject: [PATCH v5 net-next 01/10] net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error
Date: Sun, 24 Oct 2021 20:17:48 +0300	[thread overview]
Message-ID: <20211024171757.3753288-2-vladimir.oltean@nxp.com> (raw)
In-Reply-To: <20211024171757.3753288-1-vladimir.oltean@nxp.com>

At present, when either of ds->ops->port_fdb_del() or ds->ops->port_mdb_del()
return a non-zero error code, we attempt to save the day and keep the
data structure associated with that switchdev object, as the deletion
procedure did not complete.

However, the way in which we do this is suspicious to the checker in
lib/refcount.c, who thinks it is buggy to increment a refcount that
became zero, and that this is indicative of a use-after-free.

Fixes: 161ca59d39e9 ("net: dsa: reference count the MDB entries at the cross-chip notifier level")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
---
v4->v5: patch is new.

This is a minor fix and slightly unrelated to the series, but my other
patches touch this area and there isn't enough time until the merge
window to wait for another net -> net-next merge. I've annotated it with
a Fixes: tag and sent it to net-next (also made it the first patch), in
the idea that if it could be picked up by AUTOSEL it would be nice, and
if not, the problem it fixes isn't so critical anyway.

 net/dsa/switch.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 2b1b21bde830..8f8ed8248c2c 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -266,7 +266,7 @@ static int dsa_port_do_mdb_del(struct dsa_port *dp,
 
 	err = ds->ops->port_mdb_del(ds, port, mdb);
 	if (err) {
-		refcount_inc(&a->refcount);
+		refcount_set(&a->refcount, 1);
 		return err;
 	}
 
@@ -333,7 +333,7 @@ static int dsa_port_do_fdb_del(struct dsa_port *dp, const unsigned char *addr,
 
 	err = ds->ops->port_fdb_del(ds, port, addr, vid);
 	if (err) {
-		refcount_inc(&a->refcount);
+		refcount_set(&a->refcount, 1);
 		return err;
 	}
 
-- 
2.25.1


  reply	other threads:[~2021-10-24 17:18 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-24 17:17 [PATCH v5 net-next 00/10] Drop rtnl_lock from DSA .port_fdb_{add,del} Vladimir Oltean
2021-10-24 17:17 ` Vladimir Oltean [this message]
2021-10-24 17:17 ` [PATCH v5 net-next 02/10] net: dsa: sja1105: wait for dynamic config command completion on writes too Vladimir Oltean
2021-10-24 17:17 ` [PATCH v5 net-next 03/10] net: dsa: sja1105: serialize access to the dynamic config interface Vladimir Oltean
2021-10-24 17:17 ` [PATCH v5 net-next 04/10] net: mscc: ocelot: serialize access to the MAC table Vladimir Oltean
2021-10-24 17:17 ` [PATCH v5 net-next 05/10] net: dsa: b53: serialize access to the ARL table Vladimir Oltean
2021-10-24 17:17 ` [PATCH v5 net-next 06/10] net: dsa: lantiq_gswip: serialize access to the PCE registers Vladimir Oltean
2021-10-24 17:17 ` [PATCH v5 net-next 07/10] net: dsa: introduce locking for the address lists on CPU and DSA ports Vladimir Oltean
2021-10-24 17:17 ` [PATCH v5 net-next 08/10] net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work Vladimir Oltean
2021-10-24 17:17 ` [PATCH v5 net-next 09/10] selftests: lib: forwarding: allow tests to not require mz and jq Vladimir Oltean
2021-10-25  6:36   ` Ido Schimmel
2021-10-24 17:17 ` [PATCH v5 net-next 10/10] selftests: net: dsa: add a stress test for unlocked FDB operations Vladimir Oltean
2021-10-25 12:10 ` [PATCH v5 net-next 00/10] Drop rtnl_lock from DSA .port_fdb_{add,del} patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211024171757.3753288-2-vladimir.oltean@nxp.com \
    --to=vladimir.oltean@nxp.com \
    --cc=Landen.Chao@mediatek.com \
    --cc=UNGLinuxDriver@microchip.com \
    --cc=alexandre.belloni@bootlin.com \
    --cc=alsi@bang-olufsen.dk \
    --cc=andrew@lunn.ch \
    --cc=ansuelsmth@gmail.com \
    --cc=claudiu.manoil@nxp.com \
    --cc=davem@davemloft.net \
    --cc=dqfext@gmail.com \
    --cc=f.fainelli@gmail.com \
    --cc=george.mccollister@gmail.com \
    --cc=hauke@hauke-m.de \
    --cc=john@phrozen.org \
    --cc=kuba@kernel.org \
    --cc=kurt@linutronix.de \
    --cc=netdev@vger.kernel.org \
    --cc=o.rempel@pengutronix.de \
    --cc=olek2@wp.pl \
    --cc=olteanv@gmail.com \
    --cc=prasanna.vengateshan@microchip.com \
    --cc=privat@egil-hjelmeland.no \
    --cc=sean.wang@mediatek.com \
    --cc=vivien.didelot@gmail.com \
    --cc=woojung.huh@microchip.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.