All of lore.kernel.org
 help / color / mirror / Atom feed
From: Saeed Mahameed <saeedm@mellanox.com>
To: "David S. Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org, Raed Salem <raeds@mellanox.com>,
	Roi Dayan <roid@mellanox.com>, Vu Pham <vuhuong@mellanox.com>,
	Saeed Mahameed <saeedm@mellanox.com>
Subject: [net V2 08/11] net/mlx5e: Fix slab-out-of-bounds in mlx5e_rep_is_lag_netdev
Date: Tue, 28 Jul 2020 12:59:32 -0700	[thread overview]
Message-ID: <20200728195935.155604-9-saeedm@mellanox.com> (raw)
In-Reply-To: <20200728195935.155604-1-saeedm@mellanox.com>

From: Raed Salem <raeds@mellanox.com>

mlx5e_rep_is_lag_netdev is used as first check as part of netdev events
handler for bond device of non-uplink representors, this handler can get
any netdevice under the same network namespace of mlx5e netdevice. Current
code treats the netdev as mlx5e netdev and only later on verifies this,
hence causes the following Kasan trace:
[15402.744990] ==================================================================
[15402.746942] BUG: KASAN: slab-out-of-bounds in mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
[15402.749009] Read of size 8 at addr ffff880391f3f6b0 by task ovs-vswitchd/5347

[15402.752065] CPU: 7 PID: 5347 Comm: ovs-vswitchd Kdump: loaded Tainted: G    B      O     --------- -t - 4.18.0-g3dcc204d291d-dirty #1
[15402.755349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[15402.757600] Call Trace:
[15402.758968]  dump_stack+0x71/0xab
[15402.760427]  print_address_description+0x6a/0x270
[15402.761969]  kasan_report+0x179/0x2d0
[15402.763445]  ? mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
[15402.765121]  mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
[15402.766782]  mlx5e_rep_esw_bond_netevent+0x129/0x620 [mlx5_core]

Fix by deferring the violating access to be post the netdev verify check.

Fixes: 7e51891a237f ("net/mlx5e: Use netdev events to set/del egress acl forward-to-vport rule")
Signed-off-by: Raed Salem <raeds@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Vu Pham <vuhuong@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
index bdb71332cbf2d..3e44e4d820c51 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
@@ -183,13 +183,16 @@ void mlx5e_rep_bond_unslave(struct mlx5_eswitch *esw,
 
 static bool mlx5e_rep_is_lag_netdev(struct net_device *netdev)
 {
-	struct mlx5e_priv *priv = netdev_priv(netdev);
-	struct mlx5e_rep_priv *rpriv = priv->ppriv;
+	struct mlx5e_rep_priv *rpriv;
+	struct mlx5e_priv *priv;
 
 	/* A given netdev is not a representor or not a slave of LAG configuration */
 	if (!mlx5e_eswitch_rep(netdev) || !bond_slave_get_rtnl(netdev))
 		return false;
 
+	priv = netdev_priv(netdev);
+	rpriv = priv->ppriv;
+
 	/* Egress acl forward to vport is supported only non-uplink representor */
 	return rpriv->rep->vport != MLX5_VPORT_UPLINK;
 }
-- 
2.26.2


  parent reply	other threads:[~2020-07-28 20:00 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-28 19:59 [pull request][net V2 00/11] mlx5 fixes-2020-07-28 Saeed Mahameed
2020-07-28 19:59 ` [net V2 01/11] net/mlx5: E-switch, Destroy TSAR when fail to enable the mode Saeed Mahameed
2020-07-28 19:59 ` [net V2 02/11] net/mlx5: E-switch, Destroy TSAR after reload interface Saeed Mahameed
2020-07-28 19:59 ` [net V2 03/11] net/mlx5: Fix forward to next namespace Saeed Mahameed
2020-07-28 19:59 ` [net V2 04/11] net/mlx5e: Fix error path of device attach Saeed Mahameed
2020-07-28 19:59 ` [net V2 05/11] net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup Saeed Mahameed
2020-07-28 19:59 ` [net V2 06/11] net/mlx5: Fix a bug of using ptp channel index as pin index Saeed Mahameed
2020-07-28 19:59 ` [net V2 07/11] net/mlx5: Verify Hardware supports requested ptp function on a given pin Saeed Mahameed
2020-07-28 20:20   ` Jakub Kicinski
2020-07-28 19:59 ` Saeed Mahameed [this message]
2020-07-28 19:59 ` [net V2 09/11] net/mlx5: Query PPS pin operational status before registering it Saeed Mahameed
2020-07-28 19:59 ` [net V2 10/11] net/mlx5e: Modify uplink state on interface up/down Saeed Mahameed
2020-07-29  6:17   ` Or Gerlitz
2020-07-29  6:38     ` Saeed Mahameed
2020-07-28 19:59 ` [net V2 11/11] net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev Saeed Mahameed
2020-07-28 20:22 ` [pull request][net V2 00/11] mlx5 fixes-2020-07-28 Jakub Kicinski
2020-07-28 23:59 ` David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200728195935.155604-9-saeedm@mellanox.com \
    --to=saeedm@mellanox.com \
    --cc=davem@davemloft.net \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=raeds@mellanox.com \
    --cc=roid@mellanox.com \
    --cc=vuhuong@mellanox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.