Patch "mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 47efda1d62d0c5032d6b205857d731081d314fc3
Author: Ido Schimmel <idosch@xxxxxxxxxx>
Date:   Mon Apr 22 17:25:55 2024 +0200

    mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
    
    [ Upstream commit d90cfe20562407d9f080d24123078d666d730707 ]
    
    The purpose of the rehash delayed work is to reduce the number of masks
    (eRPs) used by an ACL region as the eRP bank is a global and limited
    resource.
    
    This is done in three steps:
    
    1. Creating a new set of masks and a new ACL region which will use the
       new masks and to which the existing filters will be migrated to. The
       new region is assigned to 'vregion->region' and the region from which
       the filters are migrated from is assigned to 'vregion->region2'.
    
    2. Migrating all the filters from the old region to the new region.
    
    3. Destroying the old region and setting 'vregion->region2' to NULL.
    
    Only the second steps is performed under the 'vregion->lock' mutex
    although its comments says that among other things it "Protects
    consistency of region, region2 pointers".
    
    This is problematic as the first step can race with filter insertion
    from user space that uses 'vregion->region', but under the mutex.
    
    Fix by holding the mutex across the entirety of the delayed work and not
    only during the second step.
    
    Fixes: 2bffc5322fd8 ("mlxsw: spectrum_acl: Don't take mutex in mlxsw_sp_acl_tcam_vregion_rehash_work()")
    Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
    Tested-by: Alexander Zubkov <green@xxxxxxxxxx>
    Reviewed-by: Petr Machata <petrm@xxxxxxxxxx>
    Signed-off-by: Petr Machata <petrm@xxxxxxxxxx>
    Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/1ec1d54edf2bad0a369e6b4fa030aba64e1f124b.1713797103.git.petrm@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index 483c8b75bebb8..1dce4e9958c90 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -713,7 +713,9 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work)
 			     rehash.dw.work);
 	int credits = MLXSW_SP_ACL_TCAM_VREGION_REHASH_CREDITS;
 
+	mutex_lock(&vregion->lock);
 	mlxsw_sp_acl_tcam_vregion_rehash(vregion->mlxsw_sp, vregion, &credits);
+	mutex_unlock(&vregion->lock);
 	if (credits < 0)
 		/* Rehash gone out of credits so it was interrupted.
 		 * Schedule the work as soon as possible to continue.
@@ -1353,7 +1355,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,
 	int err, err2;
 
 	trace_mlxsw_sp_acl_tcam_vregion_migrate(mlxsw_sp, vregion);
-	mutex_lock(&vregion->lock);
 	err = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion,
 						   ctx, credits);
 	if (err) {
@@ -1373,7 +1374,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,
 			/* Let the rollback to be continued later on. */
 		}
 	}
-	mutex_unlock(&vregion->lock);
 	trace_mlxsw_sp_acl_tcam_vregion_migrate_end(mlxsw_sp, vregion);
 	return err;
 }