Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: mscc: ocelot: Fix crash when adding interface under a lag

Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag")
fixed a similar issue in the lan966x driver caused by a NULL pointer dereference.
The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic
and is susceptible to the same crash.

This issue specifically affects the ocelot_vsc7514.c frontend, which leaves
unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as
it uses the DSA framework which registers all ports.

Fix this by checking if the port pointer is valid before accessing it.

Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array")
Signed-off-by: Jerry Wu <w.7erry@foxmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Jerry Wu and committed by
Jakub Kicinski
34f3ff52 3128df6b

+4 -2
+4 -2
drivers/net/ethernet/mscc/ocelot.c
··· 2307 2307 2308 2308 /* Now, set PGIDs for each active LAG */ 2309 2309 for (lag = 0; lag < ocelot->num_phys_ports; lag++) { 2310 - struct net_device *bond = ocelot->ports[lag]->bond; 2310 + struct ocelot_port *ocelot_port = ocelot->ports[lag]; 2311 2311 int num_active_ports = 0; 2312 + struct net_device *bond; 2312 2313 unsigned long bond_mask; 2313 2314 u8 aggr_idx[16]; 2314 2315 2315 - if (!bond || (visited & BIT(lag))) 2316 + if (!ocelot_port || !ocelot_port->bond || (visited & BIT(lag))) 2316 2317 continue; 2317 2318 2319 + bond = ocelot_port->bond; 2318 2320 bond_mask = ocelot_get_bond_mask(ocelot, bond); 2319 2321 2320 2322 for_each_set_bit(port, &bond_mask, ocelot->num_phys_ports) {