Bug 264469 - net/mlx4_core: fix a use-after-free
Summary: net/mlx4_core: fix a use-after-free
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: --- Affects Many People
Assignee: Hans Petter Selasky
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-06-05 09:49 UTC by ruc_gongyuanjun
Modified: 2022-06-14 09:41 UTC (History)
2 users (show)

See Also:


Attachments
a possible patch (1.75 KB, application/mbox)
2022-06-05 09:49 UTC, ruc_gongyuanjun
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description ruc_gongyuanjun 2022-06-05 09:49:12 UTC
Created attachment 234460 [details]
a possible patch

mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the rrule and then
references qpn field in rrule. The memory of rrule might be
reallocated, making the pqn field different. Fix this by saving qpn in
a local variable.
Comment 1 Hans Petter Selasky freebsd_committer freebsd_triage 2022-06-07 14:29:42 UTC
Thank you!
Comment 2 commit-hook freebsd_committer freebsd_triage 2022-06-07 14:30:16 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=dd2a8c8f72d369440c36f10512324d42ecedb5c7

commit dd2a8c8f72d369440c36f10512324d42ecedb5c7
Author:     Hans Petter Selasky <hselasky@FreeBSD.org>
AuthorDate: 2022-06-07 14:27:53 +0000
Commit:     Hans Petter Selasky <hselasky@FreeBSD.org>
CommitDate: 2022-06-07 14:28:32 +0000

    mlx4core: Use-after-free causes a resource leak in flow-steering detach

    mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
    rule (which results in freeing the rule structure), and then
    references a field in this struct (the qp number) when releasing the
    busy-status on the rule's qp.

    Since this memory was freed, it could reallocated and changed.
    Therefore, the qp number in the struct may be incorrect,
    so that we are releasing the incorrect qp. This leaves the rule's qp
    in the busy state (and could possibly release an incorrect qp as well).

    Fix this by saving the qp number in a local variable, for use after
    removing the steering rule.

    Linux commit:
    3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8

    PR:             264469
    MFC after:      1 week
    Sponsored by:   NVIDIA Networking

 sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
Comment 3 commit-hook freebsd_committer freebsd_triage 2022-06-14 09:41:27 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=be3f667388f42ac4bf4d7eaac0b3fef5dee86eac

commit be3f667388f42ac4bf4d7eaac0b3fef5dee86eac
Author:     Hans Petter Selasky <hselasky@FreeBSD.org>
AuthorDate: 2022-06-07 14:27:53 +0000
Commit:     Hans Petter Selasky <hselasky@FreeBSD.org>
CommitDate: 2022-06-14 09:39:23 +0000

    mlx4core: Use-after-free causes a resource leak in flow-steering detach

    mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
    rule (which results in freeing the rule structure), and then
    references a field in this struct (the qp number) when releasing the
    busy-status on the rule's qp.

    Since this memory was freed, it could reallocated and changed.
    Therefore, the qp number in the struct may be incorrect,
    so that we are releasing the incorrect qp. This leaves the rule's qp
    in the busy state (and could possibly release an incorrect qp as well).

    Fix this by saving the qp number in a local variable, for use after
    removing the steering rule.

    Linux commit:
    3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8

    PR:             264469
    Sponsored by:   NVIDIA Networking

    (cherry picked from commit dd2a8c8f72d369440c36f10512324d42ecedb5c7)

 sys/dev/mlx4/mlx4_core/mlx4_resource_tracker.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)