netdev - Re: [PATCH net] mlxsw: spectrum_acl: Fix use-after-free during reload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200123.113431.1301491947389006898.davem@davemloft.net>
Date:   Thu, 23 Jan 2020 11:34:31 +0100 (CET)
From:   David Miller <davem@...emloft.net>
To:     idosch@...sch.org
Cc:     netdev@...r.kernel.org, jiri@...lanox.com, mlxsw@...lanox.com,
        idosch@...lanox.com
Subject: Re: [PATCH net] mlxsw: spectrum_acl: Fix use-after-free during
 reload

From: Ido Schimmel <idosch@...sch.org>
Date: Wed, 22 Jan 2020 20:09:52 +0200

> From: Ido Schimmel <idosch@...lanox.com>
> 
> During reload (or module unload), the router block is de-initialized.
> Among other things, this results in the removal of a default multicast
> route from each active virtual router (VRF). These default routes are
> configured during initialization to trap packets to the CPU. In
> Spectrum-2, unlike Spectrum-1, multicast routes are implemented using
> ACL rules.
> 
> Since the router block is de-initialized before the ACL block, it is
> possible that the ACL rules corresponding to the default routes are
> deleted while being accessed by the ACL delayed work that queries rules'
> activity from the device. This can result in a rare use-after-free [1].
> 
> Fix this by protecting the rules list accessed by the delayed work with
> a lock. We cannot use a spinlock as the activity read operation is
> blocking.
 ...
> Fixes: cf7221a4f5a5 ("mlxsw: spectrum_router: Add Multicast routing support for Spectrum-2")
> Signed-off-by: Ido Schimmel <idosch@...lanox.com>
> Acked-by: Jiri Pirko <jiri@...lanox.com>

Applied and queued up for -stable, thanks.