From nobody Tue Jun 07 14:29:13 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 3F2747CEAEB; Tue, 7 Jun 2022 14:29:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LHXmV17fMz3wGk; Tue, 7 Jun 2022 14:29:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1654612154; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cz33jFy8XBd5dSZ1cH0pSNePeuNlGQ25eS4sTJ8qckE=; b=t7JcB1b8J6YVgEPPY3u3ZzWn2xnhKSgwvjY2N2R3J3WXgHBrBaNrk4Hirj5XzUWSUyGJnI +ZbtrAxqT0lx5yofJgsDl7AfVugXyo2fxbO5le93v6cgQcWsOwHyhXJYJB10694V/wYDBj whmQ4ckxG1+AFicVu5+2PSx3yaMVxtY3dGF9prIvghmg1FEPdZgo2izs3ucN/qb7BT1uG7 ZteTUFhzHmqpnXfw0GOUWwU5JL3yklD+mt1HsUiugX+e/Al1tteoPH/ojpMPCU1RG56wgU +zDSOl5b+fQAtTNfejcHbqokPNhTb4q4mRovNDgSCYDJLHt7vAcoSsyqg63UhQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 06FF01C9BA; Tue, 7 Jun 2022 14:29:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 257ETDGV021049; Tue, 7 Jun 2022 14:29:13 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 257ETD6x021048; Tue, 7 Jun 2022 14:29:13 GMT (envelope-from git) Date: Tue, 7 Jun 2022 14:29:13 GMT Message-Id: <202206071429.257ETD6x021048@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Hans Petter Selasky Subject: git: dd2a8c8f72d3 - main - mlx4core: Use-after-free causes a resource leak in flow-steering detach List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: hselasky X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: dd2a8c8f72d369440c36f10512324d42ecedb5c7 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1654612154; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cz33jFy8XBd5dSZ1cH0pSNePeuNlGQ25eS4sTJ8qckE=; b=XiaHW9QAQvaxVmNFwFwq3QH50GMHg9f6ifcIFm/rRrVNtq3vdqibrMhUcHJvedQ5pM0lRX hFeVi334t+wozI4VBfqn4gtoK2dnTJAu4JQ1CURezLHAuELXvxGvNdL3rrunEsd2k3vgMO 6Uc0wGQDodVZRH4AwFhUIDpJAqsvky+9EmIB9ypGxYaq7Bq8lB7JPTyFtBaoPwkOg8kFYW opfD7TfxYc1j39WavmBhARNGCDu8uLqrHN08Autqo3jEZq7eP+rbBeUzp+DpV+7FZFRzow yQqyz2zpXDbKbXRgA4lwdSUHSUbzkRzPP8YvGzPxbvPVf7Xtv7jOU0xToP0fJA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1654612154; a=rsa-sha256; cv=none; b=HcEQIIw0XxGWfchjxpQ5w6fzqRCcXzDfXLyVA/NSzxIG6VwCZR771RTnRYq2OkZI0ws/gv qoR7LadSUVO+1cLlX6MXF66gG5zqtav9SVmf8wpWj3SqsYxLmbmjHuPhfo44iii+cRZoHK 1yGfkl5M+rq1hh2KlhS/sxg14CKcpGF9uBvYWvfLtxP2ioNXZoRKSuLxmka3Rzr5N6xoN7 OpowPgai66JC61ZIdoMp33r+YE0HqdtIR5d907dVFJO8Acg6IpksPrpZ6yS9hhpI+4bcli 9y/7zIOKqsgWZQN5SdB0LpizBRlEqa4o2JJr3Aaq+sfrKyRrGacjTP+dfyn8IA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by hselasky: URL: https://cgit.FreeBSD.org/src/commit/?id=dd2a8c8f72d369440c36f10512324d42ecedb5c7 commit dd2a8c8f72d369440c36f10512324d42ecedb5c7 Author: Hans Petter Selasky AuthorDate: 2022-06-07 14:27:53 +0000 Commit: Hans Petter Selasky CommitDate: 2022-06-07 14:28:32 +0000 mlx4core: Use-after-free causes a resource leak in flow-steering detach mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering rule (which results in freeing the rule structure), and then references a field in this struct (the qp number) when releasing the busy-status on the rule's qp. Since this memory was freed, it could reallocated and changed. Therefore, the qp number in the struct may be incorrect, so that we are releasing the incorrect qp. This leaves the rule's qp in the busy state (and could possibly release an incorrect qp as well). Fix this by saving the qp number in a local variable, for use after removing the steering rule. Linux commit: 3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8 PR: 264469 MFC after: 1 week Sponsored by: NVIDIA Networking --- sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c b/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c index 95ab8a8142a5..4ebb300b5b83 100644 --- a/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c +++ b/sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c @@ -4471,6 +4471,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, struct res_qp *rqp; struct res_fs_rule *rrule; u64 mirr_reg_id; + int qpn; if (dev->caps.steering_mode != MLX4_STEERING_MODE_DEVICE_MANAGED) @@ -4487,10 +4488,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, } mirr_reg_id = rrule->mirr_rule_id; kfree(rrule->mirr_mbox); + qpn = rrule->qpn; /* Release the rule form busy state before removal */ put_res(dev, slave, vhcr->in_param, RES_FS_RULE); - err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp); + err = get_res(dev, slave, qpn, RES_QP, &rqp); if (err) return err; @@ -4515,7 +4517,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, if (!err) atomic_dec(&rqp->ref_count); out: - put_res(dev, slave, rrule->qpn, RES_QP); + put_res(dev, slave, qpn, RES_QP); return err; }