Wed, May 20, 2015 at 07:48:21AM CEST, [email protected] wrote: >rocker_port_ipv4_nh() and in turn rocker_port_ipv4_neigh() may be >be called with trans == SWITCHDEV_TRANS_PREPARE and then >trans == SWITCHDEV_TRANS_COMMIT from switchdev_port_obj_set() via >fib_table_insert(). > >The first time that rocker_port_ipv4_nh() is called, with >trans == SWITCHDEV_TRANS_PREPARE, _rocker_neigh_add() adds a new entry to >the neigh table. > >And the second time rocker_port_ipv4_nh() is called, with >trans == SWITCHDEV_TRANS_COMMIT, that entry is found. This causes >rocker_port_ipv4_nh() to believe it is not adding an entry and thus it >frees "entry", which is still present in rocker driver's neigh table. > >This problem does not appear to affect deletion as my analysis is that >deletion is always performed with trans == SWITCHDEV_TRANS_NONE. > >For completeness _rocker_neigh_{add,del,prepare} are updated not to >manipulate fib table entries if trans == SWITCHDEV_TRANS_PREPARE. > >Fixes: c4f20321d968 ("rocker: support prepare-commit transaction model") >Reported-by: oshiaki Makita <[email protected]> >Acked-by: Scott Feldman <[email protected]> >Signed-off-by: Simon Horman <[email protected]>
Acked-by: Jiri Pirko <[email protected]> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
