Commit b61cd7c6 authored by Ido Schimmel's avatar Ido Schimmel Committed by David S. Miller
Browse files

mlxsw: spectrum_router: Hold a reference on RIF's netdev



Previous patches tried to make RIF deletion more robust and avoid
use-after-free situations.

As another precaution, hold a reference on a RIF's netdev and release it
when the RIF is deleted.

Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
Reviewed-by: default avatarPetr Machata <petrm@mellanox.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 965fa8e6
...@@ -6302,6 +6302,7 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp, ...@@ -6302,6 +6302,7 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
err = -ENOMEM; err = -ENOMEM;
goto err_rif_alloc; goto err_rif_alloc;
} }
dev_hold(rif->dev);
rif->mlxsw_sp = mlxsw_sp; rif->mlxsw_sp = mlxsw_sp;
rif->ops = ops; rif->ops = ops;
...@@ -6340,6 +6341,7 @@ err_configure: ...@@ -6340,6 +6341,7 @@ err_configure:
if (fid) if (fid)
mlxsw_sp_fid_put(fid); mlxsw_sp_fid_put(fid);
err_fid_get: err_fid_get:
dev_put(rif->dev);
kfree(rif); kfree(rif);
err_rif_alloc: err_rif_alloc:
err_rif_index_alloc: err_rif_index_alloc:
...@@ -6367,6 +6369,7 @@ static void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif) ...@@ -6367,6 +6369,7 @@ static void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
if (fid) if (fid)
/* Loopback RIFs are not associated with a FID. */ /* Loopback RIFs are not associated with a FID. */
mlxsw_sp_fid_put(fid); mlxsw_sp_fid_put(fid);
dev_put(rif->dev);
kfree(rif); kfree(rif);
vr->rif_count--; vr->rif_count--;
mlxsw_sp_vr_put(mlxsw_sp, vr); mlxsw_sp_vr_put(mlxsw_sp, vr);
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment