netdev - Re: [PATCH net 6/9] mlxsw: spectrum_acl_tcam: Fix memory leak during rehash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240424145202.GH42092@kernel.org>
Date: Wed, 24 Apr 2024 15:52:02 +0100
From: Simon Horman <horms@...nel.org>
To: Petr Machata <petrm@...dia.com>
Cc: "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, Ido Schimmel <idosch@...dia.com>,
	Jiri Pirko <jiri@...nulli.us>, Alexander Zubkov <green@...tor.net>,
	mlxsw@...dia.com
Subject: Re: [PATCH net 6/9] mlxsw: spectrum_acl_tcam: Fix memory leak during
 rehash

On Mon, Apr 22, 2024 at 05:25:59PM +0200, Petr Machata wrote:
> From: Ido Schimmel <idosch@...dia.com>
> 
> The rehash delayed work migrates filters from one region to another.
> This is done by iterating over all chunks (all the filters with the same
> priority) in the region and in each chunk iterating over all the
> filters.
> 
> If the migration fails, the code tries to migrate the filters back to
> the old region. However, the rollback itself can also fail in which case
> another migration will be erroneously performed. Besides the fact that
> this ping pong is not a very good idea, it also creates a problem.
> 
> Each virtual chunk references two chunks: The currently used one
> ('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the
> first holds the chunk we want to migrate filters to and the second holds
> the chunk we are migrating filters from.
> 
> The code currently assumes - but does not verify - that the backup chunk
> does not exist (NULL) if the currently used chunk does not reference the
> target region. This assumption breaks when we are trying to rollback a
> rollback, resulting in the backup chunk being overwritten and leaked
> [1].
> 
> Fix by not rolling back a failed rollback and add a warning to avoid
> future cases.
> 
> [1]
> WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20
> Modules linked in:
> CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14
> Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
> Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
> RIP: 0010:parman_destroy+0x17/0x20
> [...]
> Call Trace:
>  <TASK>
>  mlxsw_sp_acl_atcam_region_fini+0x19/0x60
>  mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0
>  mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470
>  process_one_work+0x151/0x370
>  worker_thread+0x2cb/0x3e0
>  kthread+0xd0/0x100
>  ret_from_fork+0x34/0x50
>  ret_from_fork_asm+0x1a/0x30
>  </TASK>
> 
> Fixes: 843500518509 ("mlxsw: spectrum_acl: Do rollback as another call to mlxsw_sp_acl_tcam_vchunk_migrate_all()")
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> Tested-by: Alexander Zubkov <green@...tor.net>
> Reviewed-by: Petr Machata <petrm@...dia.com>
> Signed-off-by: Petr Machata <petrm@...dia.com>

Reviewed-by: Simon Horman <horms@...nel.org>

...