From: Jiri Pirko <[email protected]> Date: Tue, 13 Feb 2018 11:22:42 +0100
> From: Jiri Pirko <[email protected]> > > Since mlxsw_sp_fib_create() and mlxsw_sp_mr_table_create() > use ERR_PTR macro to propagate int err through return of a pointer, > the return value is not NULL in case of failure. So if one > of the calls fails, one of vr->fib4, vr->fib6 or vr->mr4_table > is not NULL and mlxsw_sp_vr_is_used wrongly assumes > that vr is in use which leads to crash like following one: > > [ 1293.949291] BUG: unable to handle kernel NULL pointer dereference at > 00000000000006c9 > [ 1293.952729] IP: mlxsw_sp_mr_table_flush+0x15/0x70 [mlxsw_spectrum] > > Fix this by using local variables to hold the pointers and set vr->* > only in case everything went fine. > > Fixes: 76610ebbde18 ("mlxsw: spectrum_router: Refactor virtual router > handling") > Fixes: a3d9bc506d64 ("mlxsw: spectrum_router: Extend virtual routers with > IPv6 support") > Fixes: d42b0965b1d4 ("mlxsw: spectrum_router: Add multicast routes > notification handling functionality") > Signed-off-by: Jiri Pirko <[email protected]> > Reviewed-by: Ido Schimmel <[email protected]> > Signed-off-by: Jiri Pirko <[email protected]> Applied and queued up for -stable.
