mirror of
git://git.openwrt.org/openwrt/openwrt.git
synced 2025-11-04 06:54:27 -05:00
34 lines
1.1 KiB
Diff
34 lines
1.1 KiB
Diff
From: Felix Fietkau <nbd@nbd.name>
|
|
Date: Mon, 20 Mar 2023 15:49:15 +0100
|
|
Subject: [PATCH] net: ethernet: mtk_eth_soc: fix flow_offload related refcount
|
|
bug
|
|
|
|
Since we call flow_block_cb_decref on FLOW_BLOCK_UNBIND, we need to call
|
|
flow_block_cb_incref unconditionally, even for a newly allocated cb.
|
|
Fixes a use-after-free bug. Also fix the accidentally inverted refcount
|
|
check on unbind.
|
|
|
|
Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support")
|
|
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
|
---
|
|
|
|
--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
|
|
+++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
|
|
@@ -584,6 +584,7 @@ mtk_eth_setup_tc_block(struct net_device
|
|
if (IS_ERR(block_cb))
|
|
return PTR_ERR(block_cb);
|
|
|
|
+ flow_block_cb_incref(block_cb);
|
|
flow_block_cb_add(block_cb, f);
|
|
list_add_tail(&block_cb->driver_list, &block_cb_list);
|
|
return 0;
|
|
@@ -592,7 +593,7 @@ mtk_eth_setup_tc_block(struct net_device
|
|
if (!block_cb)
|
|
return -ENOENT;
|
|
|
|
- if (flow_block_cb_decref(block_cb)) {
|
|
+ if (!flow_block_cb_decref(block_cb)) {
|
|
flow_block_cb_remove(block_cb, f);
|
|
list_del(&block_cb->driver_list);
|
|
}
|