net: dsa: don't leak tagger-owned storage on switch driver unbind

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: don't leak tagger-owned storage on switch driver unbind

In the initial commit dc452a471dba ("net: dsa: introduce tagger-owned

storage for private and shared data"), we had a call to

tag_ops->disconnect(dst) issued from dsa_tree_free(), which is called at

tree teardown time.

There were problems with connecting to a switch tree as a whole, so this

got reworked to connecting to individual switches within the tree. In

this process, tag_ops->disconnect(ds) was made to be called only from

switch.c (cross-chip notifiers emitted as a result of dynamic tag proto

changes), but the normal driver teardown code path wasn't replaced with

anything.

Solve this problem by adding a function that does the opposite of

dsa_switch_setup_tag_protocol(), which is called from the equivalent

spot in dsa_switch_teardown(). The positioning here also ensures that we

won't have any use-after-free in tagging protocol (*rcv) ops, since the

teardown sequence is as follows:

dsa_tree_teardown

-> dsa_tree_teardown_master

-> dsa_master_teardown

-> unsets master->dsa_ptr, making no further packets match the

ETH_P_XDSA packet type handler

-> dsa_tree_teardown_ports

-> dsa_port_teardown

-> dsa_slave_destroy

-> unregisters DSA net devices, there is even a synchronize_net()

in unregister_netdevice_many()

-> dsa_tree_teardown_switches

-> dsa_switch_teardown

-> dsa_switch_teardown_tag_protocol

-> finally frees the tagger-owned storage