[PATCH net 0/2] mlxsw: Various fixes

[PATCH net 0/2] mlxsw: Various fixes

[Ido Schimmel]

From: Ido Schimmel <idosch@mellanox.com>

Patch #1 from Jiri fixes a use-after-free discovered while fuzzing mlxsw
/ devlink with syzkaller.

Patch #2 from Amit works around a limitation in new versions of arping,
which is used in several selftests.

Amit Cohen (1):
  selftests: mlxsw: qos_mc_aware: Specify arping timeout as an integer

Jiri Pirko (1):
  mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case
    reload fails

 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     | 14 ++++++++++++--
 drivers/net/ethernet/mellanox/mlxsw/switchx2.c     |  8 ++++++++
 .../selftests/drivers/net/mlxsw/qos_mc_aware.sh    |  2 +-
 3 files changed, 21 insertions(+), 3 deletions(-)

-- 
2.26.2

[PATCH net 1/2] mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails

[Ido Schimmel]

From: Jiri Pirko <jiri@mellanox.com>

In case of reload fail, the mlxsw_sp->ports contains a pointer to a
freed memory (either by reload_down() or reload_up() error path).
Fix this by initializing the pointer to NULL and checking it before
dereferencing in split/unsplit/type_set callpaths.

Fixes: 24cc68ad6c46 ("mlxsw: core: Add support for reload")
Reported-by: Danielle Ratson <danieller@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 14 ++++++++++++--
 drivers/net/ethernet/mellanox/mlxsw/switchx2.c |  8 ++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 24ca8d5bc564..6b39978acd07 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -3986,6 +3986,7 @@ static void mlxsw_sp_ports_remove(struct mlxsw_sp *mlxsw_sp)
 			mlxsw_sp_port_remove(mlxsw_sp, i);
 	mlxsw_sp_cpu_port_remove(mlxsw_sp);
 	kfree(mlxsw_sp->ports);
+	mlxsw_sp->ports = NULL;
 }
 
 static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp)
@@ -4022,6 +4023,7 @@ static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp)
 	mlxsw_sp_cpu_port_remove(mlxsw_sp);
 err_cpu_port_create:
 	kfree(mlxsw_sp->ports);
+	mlxsw_sp->ports = NULL;
 	return err;
 }
 
@@ -4143,6 +4145,14 @@ static int mlxsw_sp_local_ports_offset(struct mlxsw_core *mlxsw_core,
 	return mlxsw_core_res_get(mlxsw_core, local_ports_in_x_res_id);
 }
 
+static struct mlxsw_sp_port *
+mlxsw_sp_port_get_by_local_port(struct mlxsw_sp *mlxsw_sp, u8 local_port)
+{
+	if (mlxsw_sp->ports && mlxsw_sp->ports[local_port])
+		return mlxsw_sp->ports[local_port];
+	return NULL;
+}
+
 static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
 			       unsigned int count,
 			       struct netlink_ext_ack *extack)
@@ -4156,7 +4166,7 @@ static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
 	int i;
 	int err;
 
-	mlxsw_sp_port = mlxsw_sp->ports[local_port];
+	mlxsw_sp_port = mlxsw_sp_port_get_by_local_port(mlxsw_sp, local_port);
 	if (!mlxsw_sp_port) {
 		dev_err(mlxsw_sp->bus_info->dev, "Port number \"%d\" does not exist\n",
 			local_port);
@@ -4251,7 +4261,7 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port,
 	int offset;
 	int i;
 
-	mlxsw_sp_port = mlxsw_sp->ports[local_port];
+	mlxsw_sp_port = mlxsw_sp_port_get_by_local_port(mlxsw_sp, local_port);
 	if (!mlxsw_sp_port) {
 		dev_err(mlxsw_sp->bus_info->dev, "Port number \"%d\" does not exist\n",
 			local_port);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
index 90535820b559..2503f61db5fb 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -1259,6 +1259,7 @@ static void mlxsw_sx_ports_remove(struct mlxsw_sx *mlxsw_sx)
 		if (mlxsw_sx_port_created(mlxsw_sx, i))
 			mlxsw_sx_port_remove(mlxsw_sx, i);
 	kfree(mlxsw_sx->ports);
+	mlxsw_sx->ports = NULL;
 }
 
 static int mlxsw_sx_ports_create(struct mlxsw_sx *mlxsw_sx)
@@ -1293,6 +1294,7 @@ static int mlxsw_sx_ports_create(struct mlxsw_sx *mlxsw_sx)
 		if (mlxsw_sx_port_created(mlxsw_sx, i))
 			mlxsw_sx_port_remove(mlxsw_sx, i);
 	kfree(mlxsw_sx->ports);
+	mlxsw_sx->ports = NULL;
 	return err;
 }
 
@@ -1376,6 +1378,12 @@ static int mlxsw_sx_port_type_set(struct mlxsw_core *mlxsw_core, u8 local_port,
 	u8 module, width;
 	int err;
 
+	if (!mlxsw_sx->ports || !mlxsw_sx->ports[local_port]) {
+		dev_err(mlxsw_sx->bus_info->dev, "Port number \"%d\" does not exist\n",
+			local_port);
+		return -EINVAL;
+	}
+
 	if (new_type == DEVLINK_PORT_TYPE_AUTO)
 		return -EOPNOTSUPP;
 
-- 
2.26.2

[PATCH net 2/2] selftests: mlxsw: qos_mc_aware: Specify arping timeout as an integer

[Ido Schimmel]

From: Amit Cohen <amitc@mellanox.com>

Starting from iputils s20190709 (used in Fedora 31), arping does not
support timeout being specified as a decimal:

$ arping -c 1 -I swp1 -b 192.0.2.66 -q -w 0.1
arping: invalid argument: '0.1'

Previously, such timeouts were rounded to an integer.

Fix this by specifying the timeout as an integer.

Fixes: a5ee171d087e ("selftests: mlxsw: qos_mc_aware: Add a test for UC awareness")
Signed-off-by: Amit Cohen <amitc@mellanox.com>
Reviewed-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
---
 tools/testing/selftests/drivers/net/mlxsw/qos_mc_aware.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/drivers/net/mlxsw/qos_mc_aware.sh b/tools/testing/selftests/drivers/net/mlxsw/qos_mc_aware.sh
index 24dd8ed48580..b025daea062d 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/qos_mc_aware.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/qos_mc_aware.sh
@@ -300,7 +300,7 @@ test_uc_aware()
 	local i
 
 	for ((i = 0; i < attempts; ++i)); do
-		if $ARPING -c 1 -I $h1 -b 192.0.2.66 -q -w 0.1; then
+		if $ARPING -c 1 -I $h1 -b 192.0.2.66 -q -w 1; then
 			((passes++))
 		fi
 
-- 
2.26.2

Re: [PATCH net 0/2] mlxsw: Various fixes

[David Miller]

From: Ido Schimmel <idosch@idosch.org>
Date: Thu, 21 May 2020 15:11:43 +0300

> From: Ido Schimmel <idosch@mellanox.com>
> 
> Patch #1 from Jiri fixes a use-after-free discovered while fuzzing mlxsw
> / devlink with syzkaller.
> 
> Patch #2 from Amit works around a limitation in new versions of arping,
> which is used in several selftests.

Series applied, thanks.

[PATCH net 0/2] mlxsw: Various fixes

[Ido Schimmel]

From: Ido Schimmel <idosch@nvidia.com>

Patch #1 fixes wrong invocation of mausezahn in a couple of selftests.
The tests started failing after Fedora updated their libnet package from
version 1.1.6 to 1.2.1. With the fix the tests pass regardless of libnet
version.

Patch #2 fixes an issue in the mirroring to CPU code that results in
policer configuration being overwritten.

Danielle Ratson (1):
  selftests: forwarding: Specify interface when invoking mausezahn

Ido Schimmel (1):
  mlxsw: spectrum_span: Do not overwrite policer configuration

 drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c        | 6 ++++++
 drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h        | 1 +
 tools/testing/selftests/net/forwarding/router_mpath_nh.sh  | 2 +-
 tools/testing/selftests/net/forwarding/router_multipath.sh | 2 +-
 4 files changed, 9 insertions(+), 2 deletions(-)

-- 
2.29.2

Re: [PATCH net 0/2] mlxsw: Various fixes

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Thu, 28 Jan 2021 16:48:18 +0200 you wrote:
> From: Ido Schimmel <idosch@nvidia.com>
> 
> Patch #1 fixes wrong invocation of mausezahn in a couple of selftests.
> The tests started failing after Fedora updated their libnet package from
> version 1.1.6 to 1.2.1. With the fix the tests pass regardless of libnet
> version.
> 
> [...]

Here is the summary with links:
  - [net,1/2] selftests: forwarding: Specify interface when invoking mausezahn
    https://git.kernel.org/netdev/net/c/11df27f7fdf0
  - [net,2/2] mlxsw: spectrum_span: Do not overwrite policer configuration
    https://git.kernel.org/netdev/net/c/b6f6881aaf23

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH net 0/2] mlxsw: Various fixes

[Ido Schimmel]

From: Ido Schimmel <idosch@mellanox.com>

Fix two issues found by syzkaller.

Patch #1 removes inappropriate usage of WARN_ON() following memory
allocation failure. Constantly triggered when syzkaller injects faults.

Patch #2 fixes a use-after-free that can be triggered by 'devlink dev
info' following a failed devlink reload.

Ido Schimmel (2):
  mlxsw: spectrum_router: Remove inappropriate usage of WARN_ON()
  mlxsw: pci: Fix use-after-free in case of failed devlink reload

 drivers/net/ethernet/mellanox/mlxsw/pci.c     | 54 +++++++++++++------
 .../ethernet/mellanox/mlxsw/spectrum_router.c |  2 +-
 2 files changed, 39 insertions(+), 17 deletions(-)

-- 
2.26.2

Re: [PATCH net 0/2] mlxsw: Various fixes

[David Miller]

From: Ido Schimmel <idosch@idosch.org>
Date: Fri, 10 Jul 2020 16:41:37 +0300

> From: Ido Schimmel <idosch@mellanox.com>
> 
> Fix two issues found by syzkaller.
> 
> Patch #1 removes inappropriate usage of WARN_ON() following memory
> allocation failure. Constantly triggered when syzkaller injects faults.
> 
> Patch #2 fixes a use-after-free that can be triggered by 'devlink dev
> info' following a failed devlink reload.

Series applied and queued up for -stable, thanks.

[PATCH net 0/2] mlxsw: Various fixes

[Ido Schimmel]

Patch #1 fixes the recently introduced QSFP thermal zones to correctly
work with split ports, where several ports are mapped to the same
module.

Patch #2 initializes the base MAC in the minimal driver. The driver is
using the base MAC as its parent ID and without initializing it, it is
reported as all zeroes to user space.

Jiri Pirko (1):
  mlxsw: minimal: Initialize base_mac

Vadim Pasternak (1):
  mlxsw: core: Prevent duplication during QSFP module initialization

 .../ethernet/mellanox/mlxsw/core_thermal.c    | 21 ++++++++++---------
 drivers/net/ethernet/mellanox/mlxsw/minimal.c | 18 ++++++++++++++++
 2 files changed, 29 insertions(+), 10 deletions(-)

-- 
2.20.1

Re: [PATCH net 0/2] mlxsw: Various fixes

[David Miller]

From: Ido Schimmel <idosch@mellanox.com>
Date: Tue, 12 Mar 2019 08:40:40 +0000

> Patch #1 fixes the recently introduced QSFP thermal zones to correctly
> work with split ports, where several ports are mapped to the same
> module.
> 
> Patch #2 initializes the base MAC in the minimal driver. The driver is
> using the base MAC as its parent ID and without initializing it, it is
> reported as all zeroes to user space.

Applied, thanks.