net/mlx5e/core/en_fs: fix pointer dereference after free in mlx5e_execute_l2_action

PATCH In review Gustavo A. R. Silva 3 participants 5 messages Nov 5, 2017 – Nov 8, 2017

Subsystems (5)

Networking Network drivers InfiniBand Mellanox mlx5 core +1 more subsystems

lore

Share & tools

lore

Gustavo A. R. Silva

author

2017-11-05 03:54 UTC #0 lore raw

PATCH 1/1 net/mlx5e/core/en_fs: fix pointer dereference after free in mlx5e_execute_l2_action

hn is being kfree'd in mlx5e_del_l2_from_hash and then dereferenced by accessing hn->ai.addr

Fix this by copying the MAC address into a local variable for its safe use in all possible execution paths within function mlx5e_execute_l2_action.

Addresses-Coverity-ID: 1417789

Fixes eeb66cdb6826 ("net/mlx5: Separate between E-Switch and MPFS")

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +8 -5

index 850cdc9..4837045 100644
@@ -365,21 +365,24 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv,
 				    struct mlx5e_l2_hash_node *hn)
 {
 	u8 action = hn->action;
+	u8 mac_addr[ETH_ALEN];
 	int l2_err = 0;
 
+	ether_addr_copy(mac_addr, hn->ai.addr);
+
 	switch (action) {
 	case MLX5E_ACTION_ADD:
 		mlx5e_add_l2_flow_rule(priv, &hn->ai, MLX5E_FULLMATCH);
-		if (!is_multicast_ether_addr(hn->ai.addr)) {
-			l2_err = mlx5_mpfs_add_mac(priv->mdev, hn->ai.addr);
+		if (!is_multicast_ether_addr(mac_addr)) {
+			l2_err = mlx5_mpfs_add_mac(priv->mdev, mac_addr);
 			hn->mpfs = !l2_err;
 		}
 		hn->action = MLX5E_ACTION_NONE;
 		break;
 
 	case MLX5E_ACTION_DEL:
-		if (!is_multicast_ether_addr(hn->ai.addr) && hn->mpfs)
-			l2_err = mlx5_mpfs_del_mac(priv->mdev, hn->ai.addr);
+		if (!is_multicast_ether_addr(mac_addr) && hn->mpfs)
+			l2_err = mlx5_mpfs_del_mac(priv->mdev, mac_addr);
 		mlx5e_del_l2_flow_rule(priv, &hn->ai);
 		mlx5e_del_l2_from_hash(hn);
 		break;

@@ -387,7 +390,7 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv,
 
 	if (l2_err)
 		netdev_warn(priv->netdev, "MPFS, failed to %s mac %pM, err(%d)\n",
-			    action == MLX5E_ACTION_ADD ? "add" : "del", hn->ai.addr, l2_err);
+			    action == MLX5E_ACTION_ADD ? "add" : "del", mac_addr, l2_err);
 }
 
 static void mlx5e_sync_netdev_addr(struct mlx5e_priv *priv)

Signature · 1 line

2.7.4

Saeed Mahameed

Acked-by on v1 1/1

2017-11-05 04:43 UTC #1 lore raw

Quoted 9 lines · Gustavo A. R. Silva

hn is being kfree'd in mlx5e_del_l2_from_hash and then dereferenced by accessing hn->ai.addr
Fix this by copying the MAC address into a local variable for its safe use in all possible execution paths within function mlx5e_execute_l2_action.
Addresses-Coverity-ID: 1417789
Fixes eeb66cdb6826 ("net/mlx5: Separate between E-Switch and MPFS")
Signed-off-by Gustavo A. R. Silva <garsilva-L1vi/[email protected]>

Acked-by Saeed Mahameed <saeedm-VPRAkNaXOzVWk0Htik3J/[email protected]>

Looks good.
Thank you Gustavo.

Quoted 49 lines

---
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +8 -6

index 850cdc9..4837045 100644
@@ -365,21 +365,24 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv,
                                    struct mlx5e_l2_hash_node *hn)
 {
        u8 action = hn->action;
+       u8 mac_addr[ETH_ALEN];
        int l2_err = 0;
 
+       ether_addr_copy(mac_addr, hn->ai.addr);
+
        switch (action) {
        case MLX5E_ACTION_ADD:
                mlx5e_add_l2_flow_rule(priv, &hn->ai, MLX5E_FULLMATCH);
-               if (!is_multicast_ether_addr(hn->ai.addr)) {
-                       l2_err = mlx5_mpfs_add_mac(priv->mdev, hn->ai.addr);
+               if (!is_multicast_ether_addr(mac_addr)) {
+                       l2_err = mlx5_mpfs_add_mac(priv->mdev, mac_addr);
                        hn->mpfs = !l2_err;
                }
                hn->action = MLX5E_ACTION_NONE;
                break;
 
        case MLX5E_ACTION_DEL:
-               if (!is_multicast_ether_addr(hn->ai.addr) && hn->mpfs)
-                       l2_err = mlx5_mpfs_del_mac(priv->mdev, hn->ai.addr);
+               if (!is_multicast_ether_addr(mac_addr) && hn->mpfs)
+                       l2_err = mlx5_mpfs_del_mac(priv->mdev, mac_addr);
                mlx5e_del_l2_flow_rule(priv, &hn->ai);
                mlx5e_del_l2_from_hash(hn);
                break;

@@ -387,7 +390,7 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv,
 
        if (l2_err)
                netdev_warn(priv->netdev, "MPFS, failed to %s mac %pM, err(%d)\n",
-                           action == MLX5E_ACTION_ADD ? "add" : "del", hn->ai.addr, l2_err);
+                           action == MLX5E_ACTION_ADD ? "add" : "del", mac_addr, l2_err);
 }
 
 static void mlx5e_sync_netdev_addr(struct mlx5e_priv *priv)
--

2.7.4

Quoted 4 lines

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Gustavo A. R. Silva

author

2017-11-06 00:45 UTC #2 lore raw

Hi Saeed,

Quoting Saeed Mahameed <[email protected]>:

Quoted 8 lines

Quoted 6 lines · Gustavo A. R. Silva
hn is being kfree'd in mlx5e_del_l2_from_hash and then dereferenced by accessing hn->ai.addr
Fix this by copying the MAC address into a local variable for its safe use in all possible execution paths within function mlx5e_execute_l2_action.

Quoted 9 lines

Quoted 3 lines
Addresses-Coverity-ID: 1417789
Fixes eeb66cdb6826 ("net/mlx5: Separate between E-Switch and MPFS")
Signed-off-by Gustavo A. R. Silva <garsilva-L1vi/[email protected]>
Acked-by Saeed Mahameed <saeedm-VPRAkNaXOzVWk0Htik3J/[email protected]>
Looks good.
Thank you Gustavo.

Glad to help.

Thanks
--
Gustavo A. R. Silva

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

David Miller

maintainer

2017-11-08 02:00 UTC #3 lore raw

In reply to Gustavo A. R. Silva

From: "Gustavo A. R. Silva" <garsilva-L1vi/[email protected]>
Date: Sat, 4 Nov 2017 22:54:53 -0500

Quoted 9 lines

hn is being kfree'd in mlx5e_del_l2_from_hash and then dereferenced by accessing hn->ai.addr
Fix this by copying the MAC address into a local variable for its safe use in all possible execution paths within function mlx5e_execute_l2_action.
Addresses-Coverity-ID: 1417789
Fixes eeb66cdb6826 ("net/mlx5: Separate between E-Switch and MPFS")
Signed-off-by Gustavo A. R. Silva <garsilva-L1vi/[email protected]>

Applied and queued up for -stable, thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Gustavo A. R. Silva

author

2017-11-08 20:55 UTC #4 lore raw

Quoting David Miller <[email protected]>:

Quoted 6 lines

From: "Gustavo A. R. Silva" <[email protected]>
Date: Sat, 4 Nov 2017 22:54:53 -0500
Quoted 3 lines
hn is being kfree'd in mlx5e_del_l2_from_hash and then dereferenced by accessing hn->ai.addr

Quoted 8 lines

Quoted 6 lines
Fix this by copying the MAC address into a local variable for its safe use in all possible execution paths within function mlx5e_execute_l2_action.
Addresses-Coverity-ID: 1417789
Fixes eeb66cdb6826 ("net/mlx5: Separate between E-Switch and MPFS")
Signed-off-by Gustavo A. R. Silva <[email protected]>
Applied and queued up for -stable, thanks.

Awesome. Thanks!

--
Gustavo A. R. Silva