• Ido Schimmel's avatar
    mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl · 993107fe
    Ido Schimmel authored
    When deleting a VLAN device using an ioctl the netdev is unregistered
    before the VLAN filter is updated via ndo_vlan_rx_kill_vid(). It can
    lead to a use-after-free in mlxsw in case the VLAN device is deleted
    while being enslaved to a bridge.
    
    The reason for the above is that when mlxsw receives the CHANGEUPPER
    event, it wrongly assumes that the VLAN device is no longer its upper
    and thus destroys the internal representation of the bridge port despite
    the reference count being non-zero.
    
    Fix this by checking if the VLAN device is our upper using its real
    device. In net-next I'm going to remove this trick and instead make
    mlxsw completely agnostic to the order of the events.
    
    Fixes: c57529e1 ("mlxsw: spectrum: Replace vPorts with Port-VLAN")
    Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
    Reviewed-by: default avatarPetr Machata <petrm@mellanox.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    993107fe
spectrum_switchdev.c 81 KB