net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()

Browse source

ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
this is the same as the port's pvid_vlan which we access afterwards,
what we're accessing is freed memory.

Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
to calling ocelot_vlan_member_del().

Fixes: d4004422f6 ("net: mscc: ocelot: track the port pvid using a pointer")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Vladimir Oltean 2022-02-15 01:42:00 +02:00 • committed by David S. Miller

parent 9ceaf6f76b

commit ef57640575

1 changed files with 5 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

drivers/net/ethernet/mscc/ocelot.c

View file