netdev - Re: [PATCH net 3/3] mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240619145101.GI690967@kernel.org>
Date: Wed, 19 Jun 2024 15:51:01 +0100
From: Simon Horman <horms@...nel.org>
To: Petr Machata <petrm@...dia.com>
Cc: "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, Ido Schimmel <idosch@...dia.com>,
	mlxsw@...dia.com, Amit Cohen <amcohen@...dia.com>
Subject: Re: [PATCH net 3/3] mlxsw: spectrum_buffers: Fix memory corruptions
 on Spectrum-4 systems

On Mon, Jun 17, 2024 at 06:56:02PM +0200, Petr Machata wrote:
> From: Ido Schimmel <idosch@...dia.com>
> 
> The following two shared buffer operations make use of the Shared Buffer
> Status Register (SBSR):
> 
>  # devlink sb occupancy snapshot pci/0000:01:00.0
>  # devlink sb occupancy clearmax pci/0000:01:00.0
> 
> The register has two masks of 256 bits to denote on which ingress /
> egress ports the register should operate on. Spectrum-4 has more than
> 256 ports, so the register was extended by cited commit with a new
> 'port_page' field.
> 
> However, when filling the register's payload, the driver specifies the
> ports as absolute numbers and not relative to the first port of the port
> page, resulting in memory corruptions [1].
> 
> Fix by specifying the ports relative to the first port of the port page.
> 
> [1]
> BUG: KASAN: slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0
> Read of size 1 at addr ffff8881068cb00f by task devlink/1566
> [...]
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0xc6/0x120
>  print_report+0xce/0x670
>  kasan_report+0xd7/0x110
>  mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0
>  mlxsw_devlink_sb_occ_snapshot+0x75/0xb0
>  devlink_nl_sb_occ_snapshot_doit+0x1f9/0x2a0
>  genl_family_rcv_msg_doit+0x20c/0x300
>  genl_rcv_msg+0x567/0x800
>  netlink_rcv_skb+0x170/0x450
>  genl_rcv+0x2d/0x40
>  netlink_unicast+0x547/0x830
>  netlink_sendmsg+0x8d4/0xdb0
>  __sys_sendto+0x49b/0x510
>  __x64_sys_sendto+0xe5/0x1c0
>  do_syscall_64+0xc1/0x1d0
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> [...]
> Allocated by task 1:
>  kasan_save_stack+0x33/0x60
>  kasan_save_track+0x14/0x30
>  __kasan_kmalloc+0x8f/0xa0
>  copy_verifier_state+0xbc2/0xfb0
>  do_check_common+0x2c51/0xc7e0
>  bpf_check+0x5107/0x9960
>  bpf_prog_load+0xf0e/0x2690
>  __sys_bpf+0x1a61/0x49d0
>  __x64_sys_bpf+0x7d/0xc0
>  do_syscall_64+0xc1/0x1d0
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Freed by task 1:
>  kasan_save_stack+0x33/0x60
>  kasan_save_track+0x14/0x30
>  kasan_save_free_info+0x3b/0x60
>  poison_slab_object+0x109/0x170
>  __kasan_slab_free+0x14/0x30
>  kfree+0xca/0x2b0
>  free_verifier_state+0xce/0x270
>  do_check_common+0x4828/0xc7e0
>  bpf_check+0x5107/0x9960
>  bpf_prog_load+0xf0e/0x2690
>  __sys_bpf+0x1a61/0x49d0
>  __x64_sys_bpf+0x7d/0xc0
>  do_syscall_64+0xc1/0x1d0
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Fixes: f8538aec88b4 ("mlxsw: Add support for more than 256 ports in SBSR register")
> Cc: Amit Cohen <amcohen@...dia.com>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> Reviewed-by: Petr Machata <petrm@...dia.com>
> Signed-off-by: Petr Machata <petrm@...dia.com>

Reviewed-by: Simon Horman <horms@...nel.org>