sfc: handle error pointers returned by rhashtable_lookup_get_insert_fast()

Several places in TC offload code assumed that the return from
 rhashtable_lookup_get_insert_fast() was always either NULL or a valid
 pointer to an existing entry, but in fact that function can return an
 error pointer.  In that case, perform the usual cleanup of the newly
 created entry, then pass up the error, rather than attempting to take a
 reference on the old entry.

Fixes: d902e1a737d4 ("sfc: bare bones TC offload on EF100")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Link: https://lore.kernel.org/r/20230919183949.59392-1-edward.cree@amd.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
index 047322b04d4f52725c01a3db3e3e3788f9fb5e02..834f000ba1c49e6b192a2d34068e1d299e5ff6a8 100644 (file)
--- a/drivers/net/ethernet/sfc/tc.c
+++ b/drivers/net/ethernet/sfc/tc.c
@@ -136,6 +136,8 @@ static struct efx_tc_mac_pedit_action *efx_tc_flower_get_mac(struct efx_nic *efx
        if (old) {
                /* don't need our new entry */
                kfree(ped);
+               if (IS_ERR(old)) /* oh dear, it's actually an error */
+                       return ERR_CAST(old);
                if (!refcount_inc_not_zero(&old->ref))
                        return ERR_PTR(-EAGAIN);
                /* existing entry found, ref taken */
@@ -602,6 +604,8 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx,
                kfree(encap);
                if (pseudo) /* don't need our new pseudo either */
                        efx_tc_flower_release_encap_match(efx, pseudo);
+               if (IS_ERR(old)) /* oh dear, it's actually an error */
+                       return PTR_ERR(old);
                /* check old and new em_types are compatible */
                switch (old->type) {
                case EFX_TC_EM_DIRECT:
@@ -700,6 +704,8 @@ static struct efx_tc_recirc_id *efx_tc_get_recirc_id(struct efx_nic *efx,
        if (old) {
                /* don't need our new entry */
                kfree(rid);
+               if (IS_ERR(old)) /* oh dear, it's actually an error */
+                       return ERR_CAST(old);
                if (!refcount_inc_not_zero(&old->ref))
                        return ERR_PTR(-EAGAIN);
                /* existing entry found */
@@ -1482,7 +1488,10 @@ static int efx_tc_flower_replace_foreign(struct efx_nic *efx,
        old = rhashtable_lookup_get_insert_fast(&efx->tc->match_action_ht,
                                                &rule->linkage,
                                                efx_tc_match_action_ht_params);
-       if (old) {
+       if (IS_ERR(old)) {
+               rc = PTR_ERR(old);
+               goto release;
+       } else if (old) {
                netif_dbg(efx, drv, efx->net_dev,
                          "Ignoring already-offloaded rule (cookie %lx)\n",
                          tc->cookie);
@@ -1697,7 +1706,10 @@ static int efx_tc_flower_replace_lhs(struct efx_nic *efx,
        old = rhashtable_lookup_get_insert_fast(&efx->tc->lhs_rule_ht,
                                                &rule->linkage,
                                                efx_tc_lhs_rule_ht_params);
-       if (old) {
+       if (IS_ERR(old)) {
+               rc = PTR_ERR(old);
+               goto release;
+       } else if (old) {
                netif_dbg(efx, drv, efx->net_dev,
                          "Already offloaded rule (cookie %lx)\n", tc->cookie);
                rc = -EEXIST;
@@ -1858,7 +1870,10 @@ static int efx_tc_flower_replace(struct efx_nic *efx,
        old = rhashtable_lookup_get_insert_fast(&efx->tc->match_action_ht,
                                                &rule->linkage,
                                                efx_tc_match_action_ht_params);
-       if (old) {
+       if (IS_ERR(old)) {
+               rc = PTR_ERR(old);
+               goto release;
+       } else if (old) {
                netif_dbg(efx, drv, efx->net_dev,
                          "Already offloaded rule (cookie %lx)\n", tc->cookie);
                NL_SET_ERR_MSG_MOD(extack, "Rule already offloaded");

diff --git a/drivers/net/ethernet/sfc/tc_conntrack.c b/drivers/net/ethernet/sfc/tc_conntrack.c
index 8e06bfbcbea17cc5c3984d37a41725e61c895433..44bb57670340dae06cad31fde1deaa60a1ae6e90 100644 (file)
--- a/drivers/net/ethernet/sfc/tc_conntrack.c
+++ b/drivers/net/ethernet/sfc/tc_conntrack.c
@@ -298,7 +298,10 @@ static int efx_tc_ct_replace(struct efx_tc_ct_zone *ct_zone,
        old = rhashtable_lookup_get_insert_fast(&efx->tc->ct_ht,
                                                &conn->linkage,
                                                efx_tc_ct_ht_params);
-       if (old) {
+       if (IS_ERR(old)) {
+               rc = PTR_ERR(old);
+               goto release;
+       } else if (old) {
                netif_dbg(efx, drv, efx->net_dev,
                          "Already offloaded conntrack (cookie %lx)\n", tc->cookie);
                rc = -EEXIST;
@@ -482,6 +485,8 @@ struct efx_tc_ct_zone *efx_tc_ct_register_zone(struct efx_nic *efx, u16 zone,
        if (old) {
                /* don't need our new entry */
                kfree(ct_zone);
+               if (IS_ERR(old)) /* oh dear, it's actually an error */
+                       return ERR_CAST(old);
                if (!refcount_inc_not_zero(&old->ref))
                        return ERR_PTR(-EAGAIN);
                /* existing entry found */

diff --git a/drivers/net/ethernet/sfc/tc_counters.c b/drivers/net/ethernet/sfc/tc_counters.c
index 0fafb47ea0824b450de43520430e41816aab9d12..c4408842432363d02bcbd64d5ab4807a444ae15e 100644 (file)
--- a/drivers/net/ethernet/sfc/tc_counters.c
+++ b/drivers/net/ethernet/sfc/tc_counters.c
@@ -236,6 +236,8 @@ struct efx_tc_counter_index *efx_tc_flower_get_counter_index(
        if (old) {
                /* don't need our new entry */
                kfree(ctr);
+               if (IS_ERR(old)) /* oh dear, it's actually an error */
+                       return ERR_CAST(old);
                if (!refcount_inc_not_zero(&old->ref))
                        return ERR_PTR(-EAGAIN);
                /* existing entry found */

diff --git a/drivers/net/ethernet/sfc/tc_encap_actions.c b/drivers/net/ethernet/sfc/tc_encap_actions.c
index 7e8bcdb222ad18b4f175d5312613402d169dfbcd..87443f9dfd22b8b82564efc31bb0d8497d3757a1 100644 (file)
--- a/drivers/net/ethernet/sfc/tc_encap_actions.c
+++ b/drivers/net/ethernet/sfc/tc_encap_actions.c
@@ -132,6 +132,8 @@ static int efx_bind_neigh(struct efx_nic *efx,
                /* don't need our new entry */
                put_net_track(neigh->net, &neigh->ns_tracker);
                kfree(neigh);
+               if (IS_ERR(old)) /* oh dear, it's actually an error */
+                       return PTR_ERR(old);
                if (!refcount_inc_not_zero(&old->ref))
                        return -EAGAIN;
                /* existing entry found, ref taken */
@@ -640,6 +642,8 @@ struct efx_tc_encap_action *efx_tc_flower_create_encap_md(
        if (old) {
                /* don't need our new entry */
                kfree(encap);
+               if (IS_ERR(old)) /* oh dear, it's actually an error */
+                       return ERR_CAST(old);
                if (!refcount_inc_not_zero(&old->ref))
                        return ERR_PTR(-EAGAIN);
                /* existing entry found, ref taken */