[bug report] net: marvell: prestera: Add router nexthops ABI

I don't know if anyone still is maintaining this driver.  Let me add
this as a KTODO in case someone wants to address it later.

KTODO: fix potential use after free in prestera_router_init()

Hello Yevhen Orlov,

Commit 0a23ae237171 ("net: marvell: prestera: Add router nexthops
ABI") from Oct 1, 2022 (linux-next), leads to the following Smatch
static checker warning:

	drivers/net/ethernet/marvell/prestera/prestera_router.c:1623 prestera_router_init()
	error: dereferencing freed memory 'sw->router->nexthop_group_ht.tbl' (line 1560)

drivers/net/ethernet/marvell/prestera/prestera_router.c
    1548 int prestera_router_init(struct prestera_switch *sw)
    1549 {
    1550         struct prestera_router *router;
    1551         int err, nhgrp_cache_bytes;
    1552 
    1553         router = kzalloc_obj(*sw->router);
    1554         if (!router)
    1555                 return -ENOMEM;
    1556 
    1557         sw->router = router;
    1558         router->sw = sw;
    1559 
    1560         err = prestera_router_hw_init(sw);
    1561         if (err)
    1562                 goto err_router_lib_init;

prestera_router_hw_init() calls rhashtable_destroy() on error but then
still returns success.

    1563 
    1564         err = rhashtable_init(&router->kern_fib_cache_ht,
    1565                               &__prestera_kern_fib_cache_ht_params);
    1566         if (err)
    1567                 goto err_kern_fib_cache_ht_init;
    1568 
    1569         err = rhashtable_init(&router->kern_neigh_cache_ht,
    1570                               &__prestera_kern_neigh_cache_ht_params);
    1571         if (err)
    1572                 goto err_kern_neigh_cache_ht_init;
    1573 
    1574         nhgrp_cache_bytes = sw->size_tbl_router_nexthop / 8 + 1;
    1575         router->nhgrp_hw_state_cache = kzalloc(nhgrp_cache_bytes, GFP_KERNEL);
    1576         if (!router->nhgrp_hw_state_cache) {
    1577                 err = -ENOMEM;
    1578                 goto err_nh_state_cache_alloc;
    1579         }
    1580 
    1581         err = prestera_neigh_work_init(sw);
    1582         if (err)
    1583                 goto err_neigh_work_init;
    1584 
    1585         router->inetaddr_valid_nb.notifier_call = __prestera_inetaddr_valid_cb;
    1586         err = register_inetaddr_validator_notifier(&router->inetaddr_valid_nb);
    1587         if (err)
    1588                 goto err_register_inetaddr_validator_notifier;
    1589 
    1590         router->inetaddr_nb.notifier_call = __prestera_inetaddr_cb;
    1591         err = register_inetaddr_notifier(&router->inetaddr_nb);
    1592         if (err)
    1593                 goto err_register_inetaddr_notifier;
    1594 
    1595         router->netevent_nb.notifier_call = prestera_router_netevent_event;
    1596         err = register_netevent_notifier(&router->netevent_nb);
    1597         if (err)
    1598                 goto err_register_netevent_notifier;
    1599 
    1600         router->fib_nb.notifier_call = __prestera_router_fib_event;
    1601         err = register_fib_notifier(&init_net, &router->fib_nb,
    1602                                     /* TODO: flush fib entries */ NULL, NULL);
    1603         if (err)
    1604                 goto err_register_fib_notifier;
    1605 
    1606         return 0;
    1607 
    1608 err_register_fib_notifier:
    1609         unregister_netevent_notifier(&router->netevent_nb);
    1610 err_register_netevent_notifier:
    1611         unregister_inetaddr_notifier(&router->inetaddr_nb);
    1612 err_register_inetaddr_notifier:
    1613         unregister_inetaddr_validator_notifier(&router->inetaddr_valid_nb);
    1614 err_register_inetaddr_validator_notifier:
    1615         prestera_neigh_work_fini(sw);
    1616 err_neigh_work_init:
    1617         kfree(router->nhgrp_hw_state_cache);
    1618 err_nh_state_cache_alloc:
    1619         rhashtable_destroy(&router->kern_neigh_cache_ht);
    1620 err_kern_neigh_cache_ht_init:
    1621         rhashtable_destroy(&router->kern_fib_cache_ht);
    1622 err_kern_fib_cache_ht_init:
--> 1623         prestera_router_hw_fini(sw);
    1624 err_router_lib_init:
    1625         kfree(sw->router);
    1626         return err;
    1627 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter