Patch "mlxsw: spectrum: Prevent mirred-related crash on removal" has been added to the 4.13-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
mlxsw: spectrum: Prevent mirred-related crash on removal
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mlxsw-spectrum-prevent-mirred-related-crash-on-removal.patch
and it can be found in the queue-4.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Mon Oct 9 09:32:35 CEST 2017
From: Yuval Mintz <[email protected]>
Date: Tue, 12 Sep 2017 08:50:53 +0200
Subject: mlxsw: spectrum: Prevent mirred-related crash on removal
From: Yuval Mintz <[email protected]>
[ Upstream commit 6399ebcccffa12e65bc15eda039d37673264ebce ]
When removing the offloading of mirred actions under matchall classifiers, mlxsw would find the destination port associated with the offloaded action and utilize it for undoing the configuration.
Depending on the order by which ports are removed, it's possible that the destination port would get removed before the source port. In such a scenario, when actions would be flushed for the source port mlxsw would perform an illegal dereference as the destination port is no longer listed.
Since the only item necessary for undoing the configuration on the destination side is the port-id and that in turn is already maintained by mlxsw on the source-port, simply stop trying to access the destination port and use the port-id directly instead.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +9 -10
@@ -572,15 +572,14 @@ static void mlxsw_sp_span_entry_destroy( }static struct mlxsw_sp_span_entry * -mlxsw_sp_span_entry_find (struct mlxsw_sp_port *port) +mlxsw_sp_span_entry_find (struct mlxsw_sp *mlxsw_sp,u8 local_port) { -struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;int i;for (i =0 ; i < mlxsw_sp->span.entries_count; i++) {struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i]; -if (curr->used && curr->local_port == port->local_port) +if (curr->used && curr->local_port == local_port)return curr; }return NULL ;
@@ -591,7 +590,8 @@ static struct mlxsw_sp_span_entry {struct mlxsw_sp_span_entry *span_entry; - span_entry =mlxsw_sp_span_entry_find (port); + span_entry =mlxsw_sp_span_entry_find (port->mlxsw_sp, + port->local_port);if (span_entry) {/* Already exists, just take a reference */ span_entry->ref_count++;
@@ -780,12 +780,13 @@ err_port_bind: }static void mlxsw_sp_span_mirror_remove (struct mlxsw_sp_port *from, -struct mlxsw_sp_port *to, +u8 destination_port,enum mlxsw_sp_span_type type) {struct mlxsw_sp_span_entry *span_entry; - span_entry =mlxsw_sp_span_entry_find (to); + span_entry =mlxsw_sp_span_entry_find (from->mlxsw_sp, + destination_port);if (!span_entry) {netdev_err (from->dev,"no span entry found\n" );return ;
@@ -1560,14 +1561,12 @@ static void mlxsw_sp_port_del_cls_matchall_mirror(struct mlxsw_sp_port *mlxsw_sp_port, struct mlxsw_sp_port_mall_mirror_tc_entry *mirror) { - struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; enum mlxsw_sp_span_type span_type; -struct mlxsw_sp_port *to_port; - to_port = mlxsw_sp->ports[mirror->to_local_port]; span_type = mirror->ingress ?MLXSW_SP_SPAN_INGRESS :MLXSW_SP_SPAN_EGRESS ; -mlxsw_sp_span_mirror_remove (mlxsw_sp_port, to_port, span_type); +mlxsw_sp_span_mirror_remove (mlxsw_sp_port, mirror->to_local_port, + span_type); } static int
Patches currently in stable-queue which might be from [email protected] are
queue-4.13/mlxsw-spectrum-prevent-mirred-related-crash-on-removal.patch