git: dd2a8c8f72d3 - main - mlx4core: Use-after-free causes a resource leak in flow-steering detach

The branch main has been updated by hselasky:

URL: https://cgit.FreeBSD.org/src/commit/?id=dd2a8c8f72d369440c36f10512324d42ecedb5c7

commit dd2a8c8f72d369440c36f10512324d42ecedb5c7
Author:     Hans Petter Selasky <hselasky@FreeBSD.org>
AuthorDate: 2022-06-07 14:27:53 +0000
Commit:     Hans Petter Selasky <hselasky@FreeBSD.org>
CommitDate: 2022-06-07 14:28:32 +0000

    mlx4core: Use-after-free causes a resource leak in flow-steering detach
    
    mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
    rule (which results in freeing the rule structure), and then
    references a field in this struct (the qp number) when releasing the
    busy-status on the rule's qp.
    
    Since this memory was freed, it could reallocated and changed.
    Therefore, the qp number in the struct may be incorrect,
    so that we are releasing the incorrect qp. This leaves the rule's qp
    in the busy state (and could possibly release an incorrect qp as well).
    
    Fix this by saving the qp number in a local variable, for use after
    removing the steering rule.
    
    Linux commit:
    3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8
    
    PR:             264469
    MFC after:      1 week
    Sponsored by:   NVIDIA Networking
---
 sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c b/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c
index 95ab8a8142a5..4ebb300b5b83 100644
--- a/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c
+++ b/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c
@@ -4471,6 +4471,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
 	struct res_qp *rqp;
 	struct res_fs_rule *rrule;
 	u64 mirr_reg_id;
+	int qpn;
 
 	if (dev->caps.steering_mode !=
 	    MLX4_STEERING_MODE_DEVICE_MANAGED)
@@ -4487,10 +4488,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
 	}
 	mirr_reg_id = rrule->mirr_rule_id;
 	kfree(rrule->mirr_mbox);
+	qpn = rrule->qpn;
 
 	/* Release the rule form busy state before removal */
 	put_res(dev, slave, vhcr->in_param, RES_FS_RULE);
-	err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp);
+	err = get_res(dev, slave, qpn, RES_QP, &rqp);
 	if (err)
 		return err;
 
@@ -4515,7 +4517,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
 	if (!err)
 		atomic_dec(&rqp->ref_count);
 out:
-	put_res(dev, slave, rrule->qpn, RES_QP);
+	put_res(dev, slave, qpn, RES_QP);
 	return err;
 }