octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()

[ Upstream commit d9c70e93ec5988ab07ad2a92d9f9d12867f02c56 ]

This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
and then dereferences it on the next line.  Two lines later, we take
a mutex so I don't think this is an RCU safe region.  Re-order it to do
the dereferences before queuing up the free.

Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/aNKCL1jKwK8GRJHh@stanley.mountain
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
index bb77ab7ddfefd3a42c5e05f303367e350eaad765..6833cbf85344586b67ff3a47f4a51b27ea100046 100644 (file)
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
@@ -1039,7 +1039,6 @@ static int otx2_tc_add_flow(struct otx2_nic *nic,
 
 free_leaf:
        otx2_tc_del_from_flow_list(flow_cfg, new_node);
-       kfree_rcu(new_node, rcu);
        if (new_node->is_act_police) {
                mutex_lock(&nic->mbox.lock);
 
@@ -1059,6 +1058,7 @@ free_leaf:
 
                mutex_unlock(&nic->mbox.lock);
        }
+       kfree_rcu(new_node, rcu);
 
        return rc;
 }