netdev - Re: [PATCH net 7/8] net/mlx5e: Fix CT entry update leaks of modify header context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15b98214-eaa0-43a1-85c4-7105d5529440@intel.com>
Date: Tue, 30 Jul 2024 11:49:24 +0200
From: Wojciech Drewek <wojciech.drewek@...el.com>
To: Tariq Toukan <tariqt@...dia.com>, "David S. Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Eric
 Dumazet" <edumazet@...gle.com>
CC: <netdev@...r.kernel.org>, Saeed Mahameed <saeedm@...dia.com>, Gal Pressman
	<gal@...dia.com>, Leon Romanovsky <leonro@...dia.com>, Chris Mi
	<cmi@...dia.com>
Subject: Re: [PATCH net 7/8] net/mlx5e: Fix CT entry update leaks of modify
 header context



On 30.07.2024 08:16, Tariq Toukan wrote:
> From: Chris Mi <cmi@...dia.com>
> 
> The cited commit allocates a new modify header to replace the old
> one when updating CT entry. But if failed to allocate a new one, eg.
> exceed the max number firmware can support, modify header will be
> an error pointer that will trigger a panic when deallocating it. And
> the old modify header point is copied to old attr. When the old
> attr is freed, the old modify header is lost.
> 
> Fix it by restoring the old attr to attr when failed to allocate a
> new modify header context. So when the CT entry is freed, the right
> modify header context will be freed. And the panic of accessing
> error pointer is also fixed.
> 
> Fixes: 94ceffb48eac ("net/mlx5e: Implement CT entry update")
> Signed-off-by: Chris Mi <cmi@...dia.com>
> Signed-off-by: Tariq Toukan <tariqt@...dia.com>
> ---

Reviewed-by: Wojciech Drewek <wojciech.drewek@...el.com>

>  drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> index 8cf8ba2622f2..71a168746ebe 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> @@ -932,6 +932,7 @@ mlx5_tc_ct_entry_replace_rule(struct mlx5_tc_ct_priv *ct_priv,
>  	mlx5_tc_ct_entry_destroy_mod_hdr(ct_priv, zone_rule->attr, mh);
>  	mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id);
>  err_mod_hdr:
> +	*attr = *old_attr;
>  	kfree(old_attr);
>  err_attr:
>  	kvfree(spec);