Commit 232deb3f authored by Vladimir Oltean's avatar Vladimir Oltean Committed by David S. Miller

net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error

At present, when either of ds->ops->port_fdb_del() or ds->ops->port_mdb_del()
return a non-zero error code, we attempt to save the day and keep the
data structure associated with that switchdev object, as the deletion
procedure did not complete.

However, the way in which we do this is suspicious to the checker in
lib/refcount.c, who thinks it is buggy to increment a refcount that
became zero, and that this is indicative of a use-after-free.

Fixes: 161ca59d ("net: dsa: reference count the MDB entries at the cross-chip notifier level")
Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2d7e73f0
...@@ -266,7 +266,7 @@ static int dsa_port_do_mdb_del(struct dsa_port *dp, ...@@ -266,7 +266,7 @@ static int dsa_port_do_mdb_del(struct dsa_port *dp,
err = ds->ops->port_mdb_del(ds, port, mdb); err = ds->ops->port_mdb_del(ds, port, mdb);
if (err) { if (err) {
refcount_inc(&a->refcount); refcount_set(&a->refcount, 1);
return err; return err;
} }
...@@ -333,7 +333,7 @@ static int dsa_port_do_fdb_del(struct dsa_port *dp, const unsigned char *addr, ...@@ -333,7 +333,7 @@ static int dsa_port_do_fdb_del(struct dsa_port *dp, const unsigned char *addr,
err = ds->ops->port_fdb_del(ds, port, addr, vid); err = ds->ops->port_fdb_del(ds, port, addr, vid);
if (err) { if (err) {
refcount_inc(&a->refcount); refcount_set(&a->refcount, 1);
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment