net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()

ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
this is the same as the port's pvid_vlan which we access afterwards,
what we're accessing is freed memory.

Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
to calling ocelot_vlan_member_del().

Fixes: d4004422f6f9 ("net: mscc: ocelot: track the port pvid using a pointer")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index e6de865..fd3ceb7 100644 (file)
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -549,14 +549,18 @@ EXPORT_SYMBOL(ocelot_vlan_add);
 int ocelot_vlan_del(struct ocelot *ocelot, int port, u16 vid)
 {
        struct ocelot_port *ocelot_port = ocelot->ports[port];
+       bool del_pvid = false;
        int err;
 
+       if (ocelot_port->pvid_vlan && ocelot_port->pvid_vlan->vid == vid)
+               del_pvid = true;
+
        err = ocelot_vlan_member_del(ocelot, port, vid);
        if (err)
                return err;
 
        /* Ingress */
-       if (ocelot_port->pvid_vlan && ocelot_port->pvid_vlan->vid == vid)
+       if (del_pvid)
                ocelot_port_set_pvid(ocelot, port, NULL);
 
        /* Egress */