mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
PATCH 1/1 mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
From: Ido Schimmel <[email protected]>
[ Upstream commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 ]
When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1].
Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam().
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Fixes 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation")
Signed-off-by Ido Schimmel <[email protected]>
Reviewed-by Amit Cohen <[email protected]>
Reviewed-by Jiri Pirko <[email protected]>
Signed-off-by Petr Machata <[email protected]>
Acked-by Paolo Abeni <[email protected]>
Link https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.1705502064.git.petrm@nvidia.com open here
Signed-off-by Jakub Kicinski <[email protected]>
[ For the function mlxsw_sp_acl_to_tcam() is not exist in 6.1.y, pick mlxsw_sp_acl_to_tcam() from commit 74cbc3c03c828ccf265a72f9bcb5aee906978744 ]
Signed-off-by Bin Lan <[email protected]>
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 5 +++++ drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.h +1 -0
@@ -970,6 +970,7 @@ enum mlxsw_sp_acl_profile { };struct mlxsw_afk *mlxsw_sp_acl_afk (struct mlxsw_sp_acl *acl); +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam (struct mlxsw_sp_acl *acl); int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_flow_block *block,
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +5 -0
@@ -40,6 +40,11 @@ struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl)return acl->afk; } +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam (struct mlxsw_sp_acl *acl) +{ +return &acl->tcam; +} +struct mlxsw_sp_acl_ruleset_ht_key {struct mlxsw_sp_flow_block *block;u32 chain_index;
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +2 -2
@@ -747,13 +747,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = mlxsw_sp_acl_to_tcam(mlxsw_sp->acl);const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini (mlxsw_sp, region->priv);mlxsw_sp_acl_tcam_region_disable (mlxsw_sp, region);mlxsw_sp_acl_tcam_region_free (mlxsw_sp, region); -mlxsw_sp_acl_tcam_region_id_put (region->group->tcam, - region->id); +mlxsw_sp_acl_tcam_region_id_put (tcam, region->id);kfree (region); }
Signature · 1 line
2.34.1
Sasha Levin
maintainer[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: efeb7dfea8ee10cdec11b6b6ba4e405edbe75809
WARNING: Author mismatch between patch and upstream commit:
Backport author: Bin Lan <[email protected]> Commit author: Ido Schimmel <[email protected]>
Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (exact SHA1)
6.6.y | Present (different SHA1: 817840d125a3)
6.1.y | Not found
Note: The patch differs from the upstream commit:
---
tmp/tmp.TYWoQ2w0cN renamed from - +41 -3
@@ -1,3 +1,5 @@ +[ Upstream commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 ] + When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1].
@@ -36,15 +38,48 @@ Acked-by: Paolo Abeni <[email protected]> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.1705502064.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski <[email protected]> +[ For the function mlxsw_sp_acl_to_tcam() is not exist in 6.1.y, pick +mlxsw_sp_acl_to_tcam() from commit 74cbc3c03c828ccf265a72f9bcb5aee906978744 ] +Signed-off-by: Bin Lan <[email protected]> --- + drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 5 +++++ drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) + 3 files changed, 8 insertions(+), 2 deletions(-) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +index c8ff2a6d7e90..57ab91133774 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +@@ -970,6 +970,7 @@ enum mlxsw_sp_acl_profile { + }; + + struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl); ++struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl); + + int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_flow_block *block, +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +index 6c5af018546f..93b71106b4c5 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +@@ -40,6 +40,11 @@ struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) + return acl->afk; + } + ++struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl) ++{ ++ return &acl->tcam; ++} ++ + struct mlxsw_sp_acl_ruleset_ht_key { + struct mlxsw_sp_flow_block *block; + u32 chain_index; diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -index d50786b0a6ce4..7d1e91196e943 100644 +index 685bcf8cbfa9..6796edb24951 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c -@@ -681,13 +681,13 @@ static void +@@ -747,13 +747,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) {
@@ -60,3 +95,6 @@ kfree(region); } +-- +2.34.1 +
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.1.y | Success | Success |