net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()
authorDima Chumak <dchumak@nvidia.com>
Mon, 26 Apr 2021 12:16:26 +0000 (15:16 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Aug 2021 10:46:44 +0000 (12:46 +0200)
commit362e9d23cf70896c65a436667449cb2d277b930f
tree5ef6fadc0d6e8ec867b31eba0a014f849095eeeb
parentbd744f2a275573f29811ebf4f0716b120c0036fd
net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()

[ Upstream commit b1c2f6312c5005c928a72e668bf305a589d828d4 ]

The result of __dev_get_by_index() is not checked for NULL and then gets
dereferenced immediately.

Also, __dev_get_by_index() must be called while holding either RTNL lock
or @dev_base_lock, which isn't satisfied by mlx5e_hairpin_get_mdev() or
its callers. This makes the underlying hlist_for_each_entry() loop not
safe, and can have adverse effects in itself.

Fix by using dev_get_by_index() and handling nullptr return value when
ifindex device is not found. Update mlx5e_hairpin_get_mdev() callers to
check for possible PTR_ERR() result.

Fixes: 77ab67b7f0f9 ("net/mlx5e: Basic setup of hairpin object")
Addresses-Coverity: ("Dereference null return value")
Signed-off-by: Dima Chumak <dchumak@nvidia.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c