On Sat, 2 Nov 2019 20:13:26 -0700, Florian Fainelli [off-list ref] wrote:
The order in which the ports are deleted from the list and freed and the
call to dsa_tree_remove_switch() is done is reversed, which leads to an
s/dsa_tree_remove_switch/dsa_switch_remove/
use after free condition. Reverse the two: first tear down the ports and
switch from the fabric, then free the ports associated with that switch
fabric.
Fixes: 05f294a85235 ("net: dsa: allocate ports on touch")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Thanks for reporting and fixing this!
Reviewed-by: Vivien Didelot <redacted>