Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1687821
| From | "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH for v4.9 LTS 10/87] net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach |
| Date | 2017-07-15 03:50 +0200 |
| Message-ID | <u3knx-3kv-41@gated-at.bofh.it> (permalink) |
| References | <u3k49-3a5-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Jack Morgenstein <jackm@dev.mellanox.co.il>
[ Upstream commit 3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8 ]
mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
rule (which results in freeing the rule structure), and then
references a field in this struct (the qp number) when releasing the
busy-status on the rule's qp.
Since this memory was freed, it could reallocated and changed.
Therefore, the qp number in the struct may be incorrect,
so that we are releasing the incorrect qp. This leaves the rule's qp
in the busy state (and could possibly release an incorrect qp as well).
Fix this by saving the qp number in a local variable, for use after
removing the steering rule.
Fixes: 2c473ae7e582 ("net/mlx4_core: Disallow releasing VF QPs which have steering rules")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 32f76bf018c3..f1eb74a61bce 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -4474,6 +4474,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
struct res_qp *rqp;
struct res_fs_rule *rrule;
u64 mirr_reg_id;
+ int qpn;
if (dev->caps.steering_mode !=
MLX4_STEERING_MODE_DEVICE_MANAGED)
@@ -4490,10 +4491,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
}
mirr_reg_id = rrule->mirr_rule_id;
kfree(rrule->mirr_mbox);
+ qpn = rrule->qpn;
/* Release the rule form busy state before removal */
put_res(dev, slave, vhcr->in_param, RES_FS_RULE);
- err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp);
+ err = get_res(dev, slave, qpn, RES_QP, &rqp);
if (err)
return err;
@@ -4518,7 +4520,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
if (!err)
atomic_dec(&rqp->ref_count);
out:
- put_res(dev, slave, rrule->qpn, RES_QP);
+ put_res(dev, slave, qpn, RES_QP);
return err;
}
--
2.11.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH for v4.9 LTS 01/87] x86/mce/AMD: Make the init code more robust "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 07/87] ARM: dts: n900: Mark eMMC slot with no-sdio and no-sd flags "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 10/87] net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 22/87] openrisc: Add _text symbol to fix ksym build error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 42/87] video: fbdev: cobalt_lcdfb: Handle return NULL error from devm_ioremap "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 20/87] ASoC: nau8825: fix invalid configuration in Pre-Scalar of FLL "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 51/87] ALSA: usb-audio: test EP_FLAG_RUNNING at urb completion "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 39/87] tools lib traceevent: Fix prev/next_prio for deadline tasks "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 33/87] usb: gadget: Fix copy/pasted error message "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 29/87] ARM64: zynqmp: Fix i2c node's compatible string "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 24/87] dmaengine: ioatdma: workaround SKX ioatdma version "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 13/87] drm/msm: Ensure that the hardware write pointer is valid "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 26/87] dmaengine: ti-dma-crossbar: Add some 'of_node_put()' in error path. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200 [PATCH for v4.9 LTS 04/87] dt-bindings: power/supply: Update TPS65217 properties "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-07-15 03:50 +0200
csiph-web