Merge branch 'mlxsw-spectrum-Various-fixes'

Jiri Pirko says:

====================
mlxsw: spectrum: Various fixes

First patch adds a missing rollback in error path. Second patch prevents
a use-after-free during IPv4 route replace. Last two patches fix warnings
from static checkers.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 192cb93e7669be9587d850bc3c5a661d9816af24..383fef5a8e24203e20137671c0924f7cc7cbfbf3 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1790,6 +1790,7 @@ static int mlxsw_sp_nexthop_init(struct mlxsw_sp *mlxsw_sp,
        return 0;
 
 err_nexthop_neigh_init:
+       mlxsw_sp_nexthop_rif_fini(nh);
        mlxsw_sp_nexthop_remove(mlxsw_sp, nh);
        return err;
 }
@@ -1866,6 +1867,7 @@ mlxsw_sp_nexthop_group_create(struct mlxsw_sp *mlxsw_sp, struct fib_info *fi)
        nh_grp->gateway = fi->fib_nh->nh_scope == RT_SCOPE_LINK;
        nh_grp->count = fi->fib_nhs;
        nh_grp->key.fi = fi;
+       fib_info_hold(fi);
        for (i = 0; i < nh_grp->count; i++) {
                nh = &nh_grp->nexthops[i];
                fib_nh = &fi->fib_nh[i];
@@ -1885,6 +1887,7 @@ mlxsw_sp_nexthop_group_create(struct mlxsw_sp *mlxsw_sp, struct fib_info *fi)
                nh = &nh_grp->nexthops[i];
                mlxsw_sp_nexthop_fini(mlxsw_sp, nh);
        }
+       fib_info_put(nh_grp->key.fi);
        kfree(nh_grp);
        return ERR_PTR(err);
 }
@@ -1903,6 +1906,7 @@ mlxsw_sp_nexthop_group_destroy(struct mlxsw_sp *mlxsw_sp,
        }
        mlxsw_sp_nexthop_group_refresh(mlxsw_sp, nh_grp);
        WARN_ON_ONCE(nh_grp->adj_index_valid);
+       fib_info_put(nh_grp->key.fi);
        kfree(nh_grp);
 }
 

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index cd89a3e6cd8184c1b80037b8a86e3dc3bc0e3a6d..656b2d3f1bee0e8aa5b1f328d5066d60f5e96099 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -979,7 +979,6 @@ mlxsw_sp_bridge_port_vlan_add(struct mlxsw_sp_port *mlxsw_sp_port,
 {
        u16 pvid = mlxsw_sp_port_pvid_determine(mlxsw_sp_port, vid, is_pvid);
        struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;
-       struct mlxsw_sp_bridge_vlan *bridge_vlan;
        u16 old_pvid = mlxsw_sp_port->pvid;
        int err;
 
@@ -1000,8 +999,6 @@ mlxsw_sp_bridge_port_vlan_add(struct mlxsw_sp_port *mlxsw_sp_port,
        if (err)
                goto err_port_vlan_bridge_join;
 
-       bridge_vlan = mlxsw_sp_bridge_vlan_find(bridge_port, vid);
-
        return 0;
 
 err_port_vlan_bridge_join:
@@ -1919,6 +1916,8 @@ static int mlxsw_sp_switchdev_event(struct notifier_block *unused,
                memcpy(&switchdev_work->fdb_info, ptr,
                       sizeof(switchdev_work->fdb_info));
                switchdev_work->fdb_info.addr = kzalloc(ETH_ALEN, GFP_ATOMIC);
+               if (!switchdev_work->fdb_info.addr)
+                       goto err_addr_alloc;
                ether_addr_copy((u8 *)switchdev_work->fdb_info.addr,
                                fdb_info->addr);
                /* Take a reference on the device. This can be either
@@ -1935,6 +1934,10 @@ static int mlxsw_sp_switchdev_event(struct notifier_block *unused,
        mlxsw_core_schedule_work(&switchdev_work->work);
 
        return NOTIFY_DONE;
+
+err_addr_alloc:
+       kfree(switchdev_work);
+       return NOTIFY_BAD;
 }
 
 static struct notifier_block mlxsw_sp_switchdev_notifier = {