lkml.org 
[lkml]   [2018]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 41/96] mlxsw: spectrum_router: Fix NULL pointer deref
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ido Schimmel <idosch@mellanox.com>


    [ Upstream commit 8764a8267b128405cf383157d5e9a4a3735d2409 ]

    When we remove the neighbour associated with a nexthop we should always
    refuse to write the nexthop to the adjacency table. Regardless if it is
    already present in the table or not.

    Otherwise, we risk dereferencing the NULL pointer that was set instead
    of the neighbour.

    Fixes: a7ff87acd995 ("mlxsw: spectrum_router: Implement next-hop routing")
    Signed-off-by: Ido Schimmel <idosch@mellanox.com>
    Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
    Signed-off-by: Jiri Pirko <jiri@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
    +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
    @@ -1328,9 +1328,9 @@ set_trap:
    static void __mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp_nexthop *nh,
    bool removing)
    {
    - if (!removing && !nh->should_offload)
    + if (!removing)
    nh->should_offload = 1;
    - else if (removing && nh->offloaded)
    + else
    nh->should_offload = 0;
    nh->update = 1;
    }

    \
     
     \ /
      Last update: 2018-01-15 14:48    [W:5.245 / U:0.228 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site