__vlan_flush() is used for both port and bridge VLAN groups. The error
path unconditionally dereferences the port argument even though
br_vlan_flush() calls it with a NULL port. Any error (e.g. switchdev) while
deleting a bridge VLAN can result in a NULL pointer dereference.
Use a bridge-specific error message when called for the bridge device.
Fixes: 5454f5c28eca ("net: bridge: vlan: check for errors from __vlan_del in
__vlan_flush")
Signed-off-by: Nikolay Aleksandrov <[email protected]>
---
net/bridge/br_vlan.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 1748ea1fc202..3aa0e1fedeb2 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -467,10 +467,15 @@ static void __vlan_flush(const struct net_bridge *br,
vid = vlan->vid;
err = __vlan_del(vlan, true);
if (err) {
- br_err(br,
- "port %u(%s) failed to delete vlan %d: %pe\n",
- (unsigned int) p->port_no, p->dev->name,
- vid, ERR_PTR(err));
+ if (p)
+ br_err(br,
+ "port %u(%s) failed to delete vlan %d:
%pe\n",
+ (unsigned int)p->port_no, p->dev->name,
+ vid, ERR_PTR(err));
+ else
+ br_err(br,
+ "failed to delete bridge vlan %d: %pe\n",
+ vid, ERR_PTR(err));
}
}
--
2.47.3
