netdev - Re: [PATCH net 4/8] net/mlx5: Use mlx5_ipsec_rx_status

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240523094747.GG883722@kernel.org>
Date: Thu, 23 May 2024 10:47:47 +0100
From: Simon Horman <horms@...nel.org>
To: Tariq Toukan <tariqt@...dia.com>
Cc: "David S. Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Eric Dumazet <edumazet@...gle.com>, netdev@...r.kernel.org,
	Saeed Mahameed <saeedm@...dia.com>, Gal Pressman <gal@...dia.com>,
	Leon Romanovsky <leonro@...dia.com>,
	Rahul Rameshbabu <rrameshbabu@...dia.com>
Subject: Re: [PATCH net 4/8] net/mlx5: Use mlx5_ipsec_rx_status_destroy to
 correctly delete status rules

On Wed, May 22, 2024 at 10:26:55PM +0300, Tariq Toukan wrote:
> From: Rahul Rameshbabu <rrameshbabu@...dia.com>
> 
> rx_create no longer allocates a modify_hdr instance that needs to be
> cleaned up. The mlx5_modify_header_dealloc call will lead to a NULL pointer
> dereference. A leak in the rules also previously occurred since there are
> now two rules populated related to status.
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   PGD 109907067 P4D 109907067 PUD 116890067 PMD 0
>   Oops: 0000 [#1] SMP
>   CPU: 1 PID: 484 Comm: ip Not tainted 6.9.0-rc2-rrameshbabu+ #254
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.3-1-1 04/01/2014
>   RIP: 0010:mlx5_modify_header_dealloc+0xd/0x70
>   <snip>
>   Call Trace:
>    <TASK>
>    ? show_regs+0x60/0x70
>    ? __die+0x24/0x70
>    ? page_fault_oops+0x15f/0x430
>    ? free_to_partial_list.constprop.0+0x79/0x150
>    ? do_user_addr_fault+0x2c9/0x5c0
>    ? exc_page_fault+0x63/0x110
>    ? asm_exc_page_fault+0x27/0x30
>    ? mlx5_modify_header_dealloc+0xd/0x70
>    rx_create+0x374/0x590
>    rx_add_rule+0x3ad/0x500
>    ? rx_add_rule+0x3ad/0x500
>    ? mlx5_cmd_exec+0x2c/0x40
>    ? mlx5_create_ipsec_obj+0xd6/0x200
>    mlx5e_accel_ipsec_fs_add_rule+0x31/0xf0
>    mlx5e_xfrm_add_state+0x426/0xc00
>   <snip>
> 
> Fixes: 94af50c0a9bb ("net/mlx5e: Unify esw and normal IPsec status table creation/destruction")
> Signed-off-by: Rahul Rameshbabu <rrameshbabu@...dia.com>
> Signed-off-by: Tariq Toukan <tariqt@...dia.com>

Reviewed-by: Simon Horman <horms@...nel.org>