CVE-2022-49808

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: don't leak tagger-owned storage on switch driver unbind

In the initial commit dc452a471dba ("net: dsa: introduce tagger-owned storage for private and shared data"), we had a call to tagops->disconnect(dst) issued from dsatree_free(), which is called at tree teardown time.

There were problems with connecting to a switch tree as a whole, so this got reworked to connecting to individual switches within the tree. In this process, tag_ops->disconnect(ds) was made to be called only from switch.c (cross-chip notifiers emitted as a result of dynamic tag proto changes), but the normal driver teardown code path wasn't replaced with anything.

Solve this problem by adding a function that does the opposite of dsaswitchsetuptagprotocol(), which is called from the equivalent spot in dsaswitchteardown(). The positioning here also ensures that we won't have any use-after-free in tagging protocol (*rcv) ops, since the teardown sequence is as follows:

dsatreeteardown -> dsatreeteardownmaster -> dsamasterteardown -> unsets master->dsaptr, making no further packets match the ETHPXDSA packet type handler -> dsatreeteardownports -> dsaportteardown -> dsaslavedestroy -> unregisters DSA net devices, there is even a synchronizenet() in unregisternetdevicemany() -> dsatreeteardownswitches -> dsaswitchteardown -> dsaswitchteardowntag_protocol -> finally frees the tagger-owned storage