From nobody Tue Jun 14 09:40:25 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 22F01846447; Tue, 14 Jun 2022 09:40:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LMk214YBsz3JY7; Tue, 14 Jun 2022 09:40:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655199625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ic0WTEmb9cHjv08eJloM7pcZ+aWLZxMghcxDduLn90g=; b=nFLR7sezl68pomEaIaCdelSCYl+D/V21mU513+I4+WZJU/clQX3FTkzWhwb7JgYAHagMVC tdj+9IzJWh4mv5pComGmDuDsDeiRMogqZkcUIqLFQ+t+Bhxa3+EtF9TiHbRw6pu3aWIslw zqmqCNWcA2nXLHgHKgPPeutXv7qFzFmXj41YmGB5tQu9hspp7eQFl3CdfHB2w4pXLb1ADe 3bpWAj/N9R+0kpn5dJimDdbYwjgjwP78N9SYV1p/yKgHySFpiIF40fbZRNx3tjK63wvJ3V TJtOvIZimOchdlhMs68peNh1nfFGSEhD53MMDyvsVo8OL0XZ9FI52o+uz5K0bA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 3E29427C1B; Tue, 14 Jun 2022 09:40:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 25E9ePgI066724; Tue, 14 Jun 2022 09:40:25 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 25E9ePBk066723; Tue, 14 Jun 2022 09:40:25 GMT (envelope-from git) Date: Tue, 14 Jun 2022 09:40:25 GMT Message-Id: <202206140940.25E9ePBk066723@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Hans Petter Selasky Subject: git: be3f667388f4 - stable/13 - mlx4core: Use-after-free causes a resource leak in flow-steering detach List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: hselasky X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: be3f667388f42ac4bf4d7eaac0b3fef5dee86eac Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655199625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ic0WTEmb9cHjv08eJloM7pcZ+aWLZxMghcxDduLn90g=; b=MF908YrwaZKkqS23vR7P9YBtOYESyUw2ajR8PZnXx02qYTiv7keMamlit600f8VeFgMuLO dUio1CAgD5ChbA0k3U2xvG3y26hhETK3xDJjlg9yAqlKOkQoHUpX13vyaPrRI4sb+Iy0qc U76korOdKqRm81pLIcI/LuVTPiKDm66TG3vvAn0i/AODJuWm5xKSZVjnfj2/GnM0s8AzEd +8AsliJbk8qRPt0kxeCazWOUIDF5SGY4Bkl/DmrsI8tytvhK7oeuGUYSWnJnRnxzfDTbd1 qwI19HvE7g3HP4kq6W3/wnNIB/AxUrPjzqZPrcBKo7/WNnVpL8zGyl4KNxOy7g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1655199625; a=rsa-sha256; cv=none; b=brYs7JFq3qmb55keTFTlvpFTHZ7P1Zw44d/UqugajxOCDtLGwnn20GveyurjhEIW8+q3Ba idN6SV5yql/s1lk9P8KrQy6CuRDprpAaUBVlHyF37UyMFbjnu1n7qKF6oYWyN7O8GxCsKV T+1qjgfuh+TJuLX90jUyTU6kEbJJNyfpu5Q0dgDBGaHhqZP90i0r8G9YgFaWawfvmIodPt B0PVk0ZqVTkZlQSqnrtfrGBWwO4EFbyqAHo1pMJQKN94qdZizsVp+i7bEAwYz451S9HOhb QLVlI9+dhUwOwVC2804/6Qv3idYpCedJHtRUIB/Ca7snUb2iVZbvOi8wWj5B+A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by hselasky: URL: https://cgit.FreeBSD.org/src/commit/?id=be3f667388f42ac4bf4d7eaac0b3fef5dee86eac commit be3f667388f42ac4bf4d7eaac0b3fef5dee86eac Author: Hans Petter Selasky AuthorDate: 2022-06-07 14:27:53 +0000 Commit: Hans Petter Selasky CommitDate: 2022-06-14 09:39:23 +0000 mlx4core: Use-after-free causes a resource leak in flow-steering detach mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering rule (which results in freeing the rule structure), and then references a field in this struct (the qp number) when releasing the busy-status on the rule's qp. Since this memory was freed, it could reallocated and changed. Therefore, the qp number in the struct may be incorrect, so that we are releasing the incorrect qp. This leaves the rule's qp in the busy state (and could possibly release an incorrect qp as well). Fix this by saving the qp number in a local variable, for use after removing the steering rule. Linux commit: 3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8 PR: 264469 Sponsored by: NVIDIA Networking (cherry picked from commit dd2a8c8f72d369440c36f10512324d42ecedb5c7) --- sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c b/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c index 95ab8a8142a5..4ebb300b5b83 100644 --- a/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c +++ b/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c @@ -4471,6 +4471,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, struct res_qp *rqp; struct res_fs_rule *rrule; u64 mirr_reg_id; + int qpn; if (dev->caps.steering_mode != MLX4_STEERING_MODE_DEVICE_MANAGED) @@ -4487,10 +4488,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, } mirr_reg_id = rrule->mirr_rule_id; kfree(rrule->mirr_mbox); + qpn = rrule->qpn; /* Release the rule form busy state before removal */ put_res(dev, slave, vhcr->in_param, RES_FS_RULE); - err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp); + err = get_res(dev, slave, qpn, RES_QP, &rqp); if (err) return err; @@ -4515,7 +4517,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, if (!err) atomic_dec(&rqp->ref_count); out: - put_res(dev, slave, rrule->qpn, RES_QP); + put_res(dev, slave, qpn, RES_QP); return err; }