mirror-linux/drivers
Vlad Buslov c382b693ff net/mlx5e: Don't clone flow post action attributes second time
[ Upstream commit e9fce818fe ]

The code already clones post action attributes in
mlx5e_clone_flow_attr_for_post_act(). Creating another copy in
mlx5e_tc_post_act_add() is a erroneous leftover from original
implementation. Instead, assign handle->attribute to post_attr provided by
the caller. Note that cloning the attribute second time is not just
wasteful but also causes issues like second copy not being properly updated
in neigh update code which leads to following use-after-free:

Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_report+0xbb/0x1a0
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30
Feb 21 09:02:00 c-237-177-40-045 kernel:  __kasan_kmalloc+0x7a/0x90
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_free_info+0x2a/0x40
Feb 21 09:02:00 c-237-177-40-045 kernel:  ____kasan_slab_free+0x11a/0x1b0
Feb 21 09:02:00 c-237-177-40-045 kernel: page dumped because: kasan: bad access detected
Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22)
Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule
Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22
Feb 21 09:02:00 c-237-177-40-045 kernel: Call Trace:
Feb 21 09:02:00 c-237-177-40-045 kernel:  <TASK>
Feb 21 09:02:00 c-237-177-40-045 kernel:  dump_stack_lvl+0x57/0x7d
Feb 21 09:02:00 c-237-177-40-045 kernel:  print_report+0x170/0x471
Feb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_report+0xbb/0x1a0
Feb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  ? __module_address.part.0+0x62/0x200
Feb 21 09:02:00 c-237-177-40-045 kernel:  ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  ? __raw_spin_lock_init+0x3b/0x110
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  add_rule_fg+0xe80/0x19c0 [mlx5_core]
--
Feb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476:
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30
Feb 21 09:02:00 c-237-177-40-045 kernel:  __kasan_kmalloc+0x7a/0x90
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  post_process_attr+0x305/0xa30 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core]
--
Feb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833:
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_stack+0x1e/0x40
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_set_track+0x21/0x30
Feb 21 09:02:00 c-237-177-40-045 kernel:  kasan_save_free_info+0x2a/0x40
Feb 21 09:02:00 c-237-177-40-045 kernel:  ____kasan_slab_free+0x11a/0x1b0
Feb 21 09:02:00 c-237-177-40-045 kernel:  __kmem_cache_free+0x1de/0x400
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5_packet_reformat_dealloc+0xad/0x100 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_tc_encap_flows_del+0x3c0/0x500 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_update_flows+0x40c/0xa80 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  mlx5e_rep_neigh_update+0x473/0x7a0 [mlx5_core]
Feb 21 09:02:00 c-237-177-40-045 kernel:  process_one_work+0x7c2/0x1310
Feb 21 09:02:00 c-237-177-40-045 kernel:  worker_thread+0x59d/0xec0
Feb 21 09:02:00 c-237-177-40-045 kernel:  kthread+0x28f/0x330

Fixes: 8300f22526 ("net/mlx5e: Create new flow attr for multi table actions")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-11 23:03:25 +09:00
..
accessibility
acpi ACPI: bus: Ensure that notify handlers are not running after removal 2023-05-11 23:03:16 +09:00
amba
android
ata ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller" 2023-03-10 09:32:32 +01:00
atm atm: idt77252: fix kmemleak when rmmod idt77252 2023-03-30 12:49:09 +02:00
auxdisplay auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() 2023-03-11 13:55:16 +01:00
base tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem 2023-05-11 23:03:01 +09:00
bcma
block block: ublk_drv: mark device as LIVE before adding disk 2023-04-20 12:35:11 +02:00
bluetooth bluetooth: btbcm: Fix logic error in forming the board name. 2023-04-20 12:35:06 +02:00
bus bus: mhi: host: Range check CHDBOFF and ERDBOFF 2023-05-11 23:03:05 +09:00
cdrom
char tpm, tpm_tis: Claim locality when interrupts are reenabled on resume 2023-05-11 23:03:06 +09:00
clk clk: rs9: Fix suspend/resume 2023-04-20 12:35:08 +02:00
clocksource clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use 2023-03-10 09:33:03 +01:00
comedi
connector
counter counter: 104-quad-8: Fix Synapse action reported for Index signals 2023-04-13 16:55:31 +02:00
cpufreq cpufreq: use correct unit when verify cur freq 2023-05-11 23:03:16 +09:00
cpuidle RISC-V: Align SBI probe implementation with spec 2023-05-11 23:03:04 +09:00
crypto crypto: sa2ul - Select CRYPTO_DES 2023-05-11 23:03:20 +09:00
cxl cxl/hdm: Fail upon detecting 0-sized decoders 2023-05-11 23:03:05 +09:00
dax dax/kmem: Fix leak of memory-hotplug resources 2023-03-10 09:34:25 +01:00
dca
devfreq
dio
dma dmaengine: apple-admac: Fix 'current_tx' not getting freed 2023-04-20 12:35:08 +02:00
dma-buf dma-buf: actually set signaling bit for private stub fences 2023-02-09 11:28:23 +01:00
edac EDAC/skx: Fix overflows on the DRAM row address mapping arrays 2023-05-11 23:03:08 +09:00
eisa
extcon
firewire
firmware firmware: arm_scmi: Fix xfers allocation on Rx channel 2023-05-11 23:03:11 +09:00
fpga fpga: bridge: properly initialize bridge device before populating children 2023-04-26 14:28:43 +02:00
fsi
gnss
gpio gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xNU 2023-05-01 08:26:27 +09:00
gpu drm/i915: Make intel_get_crtc_new_encoder() less oopsy 2023-05-11 23:03:16 +09:00
greybus
hid HID: intel-ish-hid: Fix kernel panic during warm reset 2023-04-20 12:35:13 +02:00
hsi
hte
hv Drivers: vmbus: Check for channel allocation before looking up relids 2023-04-13 16:55:18 +02:00
hwmon hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E 2023-05-11 23:03:16 +09:00
hwspinlock
hwtracing coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug 2023-04-13 16:55:30 +02:00
i2c i2c: omap: Fix standard mode false ACK readings 2023-05-11 23:03:04 +09:00
i3c
idle Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*" 2023-04-06 12:10:58 +02:00
iio iio: addac: stx104: Fix race condition for stx104_write_raw() 2023-05-11 23:03:01 +09:00
infiniband scsi: target: iscsit: isert: Alloc per conn cmd counter 2023-05-11 23:03:19 +09:00
input Input: pegasus-notetaker - check pipe type when probing 2023-04-26 14:28:43 +02:00
interconnect interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT 2023-03-30 12:48:59 +02:00
iommu iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE 2023-05-11 23:03:04 +09:00
ipack
irqchip irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts 2023-03-10 09:33:07 +01:00
isdn
leds pwm: Make .get_state() callback return an error code 2023-04-13 16:55:18 +02:00
macintosh macintosh: windfarm: Use unsigned type for 1-bit bitfields 2023-03-17 08:50:31 +01:00
mailbox mailbox: mpfs: switch to txdone_poll 2023-05-11 23:03:12 +09:00
mcb
md md/raid10: don't call bio_start_io_acct twice for bio which experienced read error 2023-05-11 23:03:23 +09:00
media media: mediatek: vcodec: add remove function for decoder platform driver 2023-05-11 23:03:16 +09:00
memory memory: tegra30-emc: fix interconnect registration race 2023-03-22 13:33:56 +01:00
memstick memstick: fix memory leak if card device is never registered 2023-04-26 14:28:39 +02:00
message
mfd mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak 2023-03-11 13:55:32 +01:00
misc misc: vmw_balloon: fix memory leak with using debugfs_lookup() 2023-03-11 13:55:39 +01:00
mmc mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data 2023-05-11 23:03:11 +09:00
most
mtd ubi: Fix return value overwrite issue in try_write_vid_and_data() 2023-05-11 23:03:05 +09:00
mux
net net/mlx5e: Don't clone flow post action attributes second time 2023-05-11 23:03:25 +09:00
nfc nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition 2023-03-22 13:33:46 +01:00
ntb
nubus
nvdimm cxl/pmem: Fix nvdimm registration races 2023-03-10 09:34:20 +01:00
nvme nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage" 2023-05-11 23:03:22 +09:00
nvmem nvmem: core: fix return value 2023-02-09 11:28:25 +01:00
of of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem 2023-02-22 12:59:46 +01:00
opp OPP: fix error checking in opp_migrate_dentry() 2023-03-10 09:33:01 +01:00
parisc
parport
pci PCI: qcom: Fix the incorrect register usage in v2.7.0 config 2023-05-11 23:02:59 +09:00
pcmcia
peci
perf perf/arm-cmn: Fix port detection for CMN-700 2023-05-11 23:03:16 +09:00
phy phy: qcom-qmp-pcie: sc8180x PCIe PHY has 2 lanes 2023-05-11 23:02:59 +09:00
pinctrl pinctrl: qcom: lpass-lpi: set output value before enabling output 2023-05-11 23:03:02 +09:00
platform platform/chrome: cros_typec_switch: Add missing fwnode_handle_put() 2023-05-11 23:03:16 +09:00
pnp
power power: supply: axp288_fuel_gauge: Added check for negative values 2023-04-20 12:35:10 +02:00
powercap powercap: fix possible name leak in powercap_register_zone() 2023-03-10 09:32:56 +01:00
pps
ps3
ptp ptp_qoriq: fix memory leak in probe() 2023-04-06 12:10:44 +02:00
pwm pwm: meson: Fix g12a ao clk81 name 2023-05-11 23:03:02 +09:00
rapidio
ras
regulator regulator: stm32-pwr: fix of_iomap leak 2023-05-11 23:03:16 +09:00
remoteproc remoteproc/mtk_scp: Move clk ops outside send_lock 2023-03-10 09:34:26 +01:00
reset
rpmsg rpmsg: glink: Propagate TX failures in intentless mode as well 2023-05-11 23:03:16 +09:00
rtc rtc: allow rtc_read_alarm without read_alarm callback 2023-03-11 13:55:30 +01:00
s390 s390/vfio-ap: fix memory leak in vfio_ap device driver 2023-04-06 12:10:46 +02:00
sbus
scsi scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() 2023-05-11 23:03:21 +09:00
sh
siox
slimbus
soc soc: renesas: renesas-soc: Release 'chipid' from ioremap() 2023-05-11 23:03:12 +09:00
soundwire soundwire: qcom: correct setting ignore bit on v1.5.1 2023-05-11 23:03:02 +09:00
spi spi: spi-rockchip: Fix missing unwind goto in rockchip_sfc_probe() 2023-04-26 14:28:34 +02:00
spmi
ssb
staging media: rkvdec: fix use after free bug in rkvdec_remove 2023-05-11 23:03:14 +09:00
target scsi: target: iscsit: Fix TAS handling during conn cleanup 2023-05-11 23:03:19 +09:00
tc
tee tee: amdtee: fix race condition in amdtee_open_session 2023-03-30 12:49:29 +02:00
thermal thermal: intel: BXT_PMIC: select REGMAP instead of depending on it 2023-03-11 13:55:32 +01:00
thunderbolt thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers 2023-04-06 12:10:33 +02:00
tty serial: max310x: fix IO data corruption in batched operations 2023-05-11 23:03:01 +09:00
ufs scsi: ufs: core: Add soft dependency on governor_simpleondemand 2023-03-30 12:49:17 +02:00
uio
usb scsi: target: Pass in cmd counter to use during cmd setup 2023-05-11 23:03:19 +09:00
vdpa vp_vdpa: fix the crash in hot unplug with vp_vdpa 2023-03-22 13:34:03 +01:00
vfio vfio/type1: restore locked_vm 2023-03-10 09:34:32 +01:00
vhost vhost-vdpa: free iommu domain after last use during cleanup 2023-03-22 13:33:44 +01:00
video fbcon: set_con2fb_map needs to set con2fb_map! 2023-04-20 12:35:07 +02:00
virt virt/coco/sev-guest: Double-buffer messages 2023-05-11 23:03:10 +09:00
virtio
vlynq
w1
watchdog watchdog: sbsa_wdog: Make sure the timeout programming is within the limits 2023-03-11 13:55:24 +01:00
xen ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 2023-05-11 23:03:11 +09:00
zorro
Kconfig
Makefile