netdev - RE: [PATCH iwl-net 1/2] ice: Fix deinitializing VF in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <PH0PR11MB5013367C7BE03CD20B4160C996C72@PH0PR11MB5013.namprd11.prod.outlook.com>
Date: Fri, 21 Feb 2025 08:15:50 +0000
From: "Buvaneswaran, Sujai" <sujai.buvaneswaran@...el.com>
To: Marcin Szycik <marcin.szycik@...ux.intel.com>,
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"michal.swiatkowski@...ux.intel.com" <michal.swiatkowski@...ux.intel.com>,
	Martyna Szapar-Mudlaw <martyna.szapar-mudlaw@...ux.intel.com>
Subject: RE: [PATCH iwl-net 1/2] ice: Fix deinitializing VF in error path

> -----Original Message-----
> From: Marcin Szycik <marcin.szycik@...ux.intel.com>
> Sent: Tuesday, February 11, 2025 11:13 PM
> To: intel-wired-lan@...ts.osuosl.org
> Cc: netdev@...r.kernel.org; michal.swiatkowski@...ux.intel.com; Marcin
> Szycik <marcin.szycik@...ux.intel.com>; Buvaneswaran, Sujai
> <sujai.buvaneswaran@...el.com>; Martyna Szapar-Mudlaw
> <martyna.szapar-mudlaw@...ux.intel.com>
> Subject: [PATCH iwl-net 1/2] ice: Fix deinitializing VF in error path
> 
> If ice_ena_vfs() fails after calling ice_create_vf_entries(), it frees all VFs
> without removing them from snapshot PF-VF mailbox list, leading to list
> corruption.
> 
> Reproducer:
>   devlink dev eswitch set $PF1_PCI mode switchdev
>   ip l s $PF1 up
>   ip l s $PF1 promisc on
>   sleep 1
>   echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
>   sleep 1
>   echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
> 
> Trace (minimized):
>   list_add corruption. next->prev should be prev (ffff8882e241c6f0), but was
> 0000000000000000. (next=ffff888455da1330).
>   kernel BUG at lib/list_debug.c:29!
>   RIP: 0010:__list_add_valid_or_report+0xa6/0x100
>    ice_mbx_init_vf_info+0xa7/0x180 [ice]
>    ice_initialize_vf_entry+0x1fa/0x250 [ice]
>    ice_sriov_configure+0x8d7/0x1520 [ice]
>    ? __percpu_ref_switch_mode+0x1b1/0x5d0
>    ? __pfx_ice_sriov_configure+0x10/0x10 [ice]
> 
> Sometimes a KASAN report can be seen instead with a similar stack trace:
>   BUG: KASAN: use-after-free in __list_add_valid_or_report+0xf1/0x100
> 
> VFs are added to this list in ice_mbx_init_vf_info(), but only removed in
> ice_free_vfs(). Move the removing to ice_free_vf_entries(), which is also
> being called in other places where VFs are being removed (including
> ice_free_vfs() itself).
> 
> Fixes: 8cd8a6b17d27 ("ice: move VF overflow message count into struct
> ice_mbx_vf_info")
> Reported-by: Sujai Buvaneswaran <sujai.buvaneswaran@...el.com>
> Closes: https://lore.kernel.org/intel-wired-
> lan/PH0PR11MB50138B635F2E5CEB7075325D961F2@...PR11MB5013.nam
> prd11.prod.outlook.com
> Reviewed-by: Martyna Szapar-Mudlaw <martyna.szapar-
> mudlaw@...ux.intel.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@...ux.intel.com>
> ---
>  drivers/net/ethernet/intel/ice/ice_sriov.c          | 5 +----
>  drivers/net/ethernet/intel/ice/ice_vf_lib.c         | 8 ++++++++
>  drivers/net/ethernet/intel/ice/ice_vf_lib_private.h | 1 +
>  3 files changed, 10 insertions(+), 4 deletions(-)
> 
Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@...el.com>