Patch "net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error" has been added to the 5.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error

to the 5.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-dsa-avoid-refcount-warnings-when-port_-fdb-mdb-_.patch
and it can be found in the queue-5.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f6a5784c7989b01c92c180669d9d70cfb613c9c3
Author: Vladimir Oltean <vladimir.oltean@xxxxxxx>
Date:   Sun Oct 24 20:17:48 2021 +0300

    net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error
    
    [ Upstream commit 232deb3f9567ce37d99b8616a6c07c1fc0436abf ]
    
    At present, when either of ds->ops->port_fdb_del() or ds->ops->port_mdb_del()
    return a non-zero error code, we attempt to save the day and keep the
    data structure associated with that switchdev object, as the deletion
    procedure did not complete.
    
    However, the way in which we do this is suspicious to the checker in
    lib/refcount.c, who thinks it is buggy to increment a refcount that
    became zero, and that this is indicative of a use-after-free.
    
    Fixes: 161ca59d39e9 ("net: dsa: reference count the MDB entries at the cross-chip notifier level")
    Signed-off-by: Vladimir Oltean <vladimir.oltean@xxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 9ef9125713321..41f62c3ab9671 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -243,7 +243,7 @@ static int dsa_switch_do_mdb_del(struct dsa_switch *ds, int port,
 
 	err = ds->ops->port_mdb_del(ds, port, mdb);
 	if (err) {
-		refcount_inc(&a->refcount);
+		refcount_set(&a->refcount, 1);
 		return err;
 	}
 
@@ -308,7 +308,7 @@ static int dsa_switch_do_fdb_del(struct dsa_switch *ds, int port,
 
 	err = ds->ops->port_fdb_del(ds, port, addr, vid);
 	if (err) {
-		refcount_inc(&a->refcount);
+		refcount_set(&a->refcount, 1);
 		return err;
 	}