Patch "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update" has been added to the 6.8-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 95cece06219469eb2fa4e995818eb8e0e692dedf
Author: Ido Schimmel <idosch@xxxxxxxxxx>
Date:   Mon Apr 22 17:25:56 2024 +0200

    mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
    
    [ Upstream commit 79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4 ]
    
    The rule activity update delayed work periodically traverses the list of
    configured rules and queries their activity from the device.
    
    As part of this task it accesses the entry pointed by 'ventry->entry',
    but this entry can be changed concurrently by the rehash delayed work,
    leading to a use-after-free [1].
    
    Fix by closing the race and perform the activity query under the
    'vregion->lock' mutex.
    
    [1]
    BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140
    Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181
    
    CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2
    Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
    Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0xc6/0x120
     print_report+0xce/0x670
     kasan_report+0xd7/0x110
     mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140
     mlxsw_sp_acl_rule_activity_update_work+0x219/0x400
     process_one_work+0x8eb/0x19b0
     worker_thread+0x6c9/0xf70
     kthread+0x2c9/0x3b0
     ret_from_fork+0x4d/0x80
     ret_from_fork_asm+0x1a/0x30
     </TASK>
    
    Allocated by task 1039:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0x8f/0xa0
     __kmalloc+0x19c/0x360
     mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0
     mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50
     mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300
     process_one_work+0x8eb/0x19b0
     worker_thread+0x6c9/0xf70
     kthread+0x2c9/0x3b0
     ret_from_fork+0x4d/0x80
     ret_from_fork_asm+0x1a/0x30
    
    Freed by task 1039:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3b/0x60
     poison_slab_object+0x102/0x170
     __kasan_slab_free+0x14/0x30
     kfree+0xc1/0x290
     mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50
     mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300
     process_one_work+0x8eb/0x19b0
     worker_thread+0x6c9/0xf70
     kthread+0x2c9/0x3b0
     ret_from_fork+0x4d/0x80
     ret_from_fork_asm+0x1a/0x30
    
    Fixes: 2bffc5322fd8 ("mlxsw: spectrum_acl: Don't take mutex in mlxsw_sp_acl_tcam_vregion_rehash_work()")
    Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
    Tested-by: Alexander Zubkov <green@xxxxxxxxxx>
    Reviewed-by: Petr Machata <petrm@xxxxxxxxxx>
    Signed-off-by: Petr Machata <petrm@xxxxxxxxxx>
    Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/1fcce0a60b231ebeb2515d91022284ba7b4ffe7a.1713797103.git.petrm@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index 9c0c728bb42dc..7e69225c057de 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -1159,8 +1159,14 @@ mlxsw_sp_acl_tcam_ventry_activity_get(struct mlxsw_sp *mlxsw_sp,
 				      struct mlxsw_sp_acl_tcam_ventry *ventry,
 				      bool *activity)
 {
-	return mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp,
-						    ventry->entry, activity);
+	struct mlxsw_sp_acl_tcam_vregion *vregion = ventry->vchunk->vregion;
+	int err;
+
+	mutex_lock(&vregion->lock);
+	err = mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, ventry->entry,
+						   activity);
+	mutex_unlock(&vregion->lock);
+	return err;
 }
 
 static int




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux