From: Greg Kroah-Hartman Date: Mon, 27 Nov 2023 12:43:09 +0000 (+0000) Subject: 6.5-stable patches X-Git-Tag: v4.14.331~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d039f3285fefc6e31a05faee72222a4753ee1205;p=thirdparty%2Fkernel%2Fstable-queue.git 6.5-stable patches added patches: net-mlx5e-avoid-referencing-skb-after-free-ing-in-drop-path-of-mlx5e_sq_xmit_wqe.patch net-mlx5e-track-xmit-submission-to-ptp-wq-after-populating-metadata-map.patch --- diff --git a/queue-6.5/net-mlx5e-avoid-referencing-skb-after-free-ing-in-drop-path-of-mlx5e_sq_xmit_wqe.patch b/queue-6.5/net-mlx5e-avoid-referencing-skb-after-free-ing-in-drop-path-of-mlx5e_sq_xmit_wqe.patch new file mode 100644 index 00000000000..565c4573848 --- /dev/null +++ b/queue-6.5/net-mlx5e-avoid-referencing-skb-after-free-ing-in-drop-path-of-mlx5e_sq_xmit_wqe.patch @@ -0,0 +1,38 @@ +From 64f14d16eef1f939000f2617b50c7c996b5117d4 Mon Sep 17 00:00:00 2001 +From: Rahul Rameshbabu +Date: Tue, 14 Nov 2023 13:58:40 -0800 +Subject: net/mlx5e: Avoid referencing skb after free-ing in drop path of mlx5e_sq_xmit_wqe + +From: Rahul Rameshbabu + +commit 64f14d16eef1f939000f2617b50c7c996b5117d4 upstream. + +When SQ is a port timestamping SQ for PTP, do not access tx flags of skb +after free-ing the skb. Free the skb only after all references that depend +on it have been handled in the dropped WQE path. + +Fixes: 3178308ad4ca ("net/mlx5e: Make tx_port_ts logic resilient to out-of-order CQEs") +Signed-off-by: Rahul Rameshbabu +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20231114215846.5902-10-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -494,10 +494,10 @@ mlx5e_sq_xmit_wqe(struct mlx5e_txqsq *sq + + err_drop: + stats->dropped++; +- dev_kfree_skb_any(skb); + if (unlikely(sq->ptpsq && (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP))) + mlx5e_ptp_metadata_fifo_push(&sq->ptpsq->metadata_freelist, + be32_to_cpu(eseg->flow_table_metadata)); ++ dev_kfree_skb_any(skb); + mlx5e_tx_flush(sq); + } + diff --git a/queue-6.5/net-mlx5e-track-xmit-submission-to-ptp-wq-after-populating-metadata-map.patch b/queue-6.5/net-mlx5e-track-xmit-submission-to-ptp-wq-after-populating-metadata-map.patch new file mode 100644 index 00000000000..1d72c7abb95 --- /dev/null +++ b/queue-6.5/net-mlx5e-track-xmit-submission-to-ptp-wq-after-populating-metadata-map.patch @@ -0,0 +1,110 @@ +From 7e3f3ba97e6cc6fce5bf62df2ca06c8e59040167 Mon Sep 17 00:00:00 2001 +From: Rahul Rameshbabu +Date: Tue, 14 Nov 2023 13:58:41 -0800 +Subject: net/mlx5e: Track xmit submission to PTP WQ after populating metadata map + +From: Rahul Rameshbabu + +commit 7e3f3ba97e6cc6fce5bf62df2ca06c8e59040167 upstream. + +Ensure the skb is available in metadata mapping to skbs before tracking the +metadata index for detecting undelivered CQEs. If the metadata index is put +in the tracking list before putting the skb in the map, the metadata index +might be used for detecting undelivered CQEs before the relevant skb is +available in the map, which can lead to a null-ptr-deref. + +Log: + general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN + KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] + CPU: 0 PID: 1243 Comm: kworker/0:2 Not tainted 6.6.0-rc4+ #108 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + Workqueue: events mlx5e_rx_dim_work [mlx5_core] + RIP: 0010:mlx5e_ptp_napi_poll+0x9a4/0x2290 [mlx5_core] + Code: 8c 24 38 cc ff ff 4c 8d 3c c1 4c 89 f9 48 c1 e9 03 42 80 3c 31 00 0f 85 97 0f 00 00 4d 8b 3f 49 8d 7f 28 48 89 f9 48 c1 e9 03 <42> 80 3c 31 00 0f 85 8b 0f 00 00 49 8b 47 28 48 85 c0 0f 84 05 07 + RSP: 0018:ffff8884d3c09c88 EFLAGS: 00010206 + RAX: 0000000000000069 RBX: ffff8881160349d8 RCX: 0000000000000005 + RDX: ffffed10218f48cf RSI: 0000000000000004 RDI: 0000000000000028 + RBP: ffff888122707700 R08: 0000000000000001 R09: ffffed109a781383 + R10: 0000000000000003 R11: 0000000000000003 R12: ffff88810c7a7a40 + R13: ffff888122707700 R14: dffffc0000000000 R15: 0000000000000000 + FS: 0000000000000000(0000) GS:ffff8884d3c00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f4f878dd6e0 CR3: 000000014d108002 CR4: 0000000000370eb0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? die_addr+0x3c/0xa0 + ? exc_general_protection+0x144/0x210 + ? asm_exc_general_protection+0x22/0x30 + ? mlx5e_ptp_napi_poll+0x9a4/0x2290 [mlx5_core] + ? mlx5e_ptp_napi_poll+0x8f6/0x2290 [mlx5_core] + __napi_poll.constprop.0+0xa4/0x580 + net_rx_action+0x460/0xb80 + ? _raw_spin_unlock_irqrestore+0x32/0x60 + ? __napi_poll.constprop.0+0x580/0x580 + ? tasklet_action_common.isra.0+0x2ef/0x760 + __do_softirq+0x26c/0x827 + irq_exit_rcu+0xc2/0x100 + common_interrupt+0x7f/0xa0 + + + asm_common_interrupt+0x22/0x40 + RIP: 0010:__kmem_cache_alloc_node+0xb/0x330 + Code: 41 5d 41 5e 41 5f c3 8b 44 24 14 8b 4c 24 10 09 c8 eb d5 e8 b7 43 ca 01 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 <41> 56 41 89 d6 41 55 41 89 f5 41 54 49 89 fc 53 48 83 e4 f0 48 83 + RSP: 0018:ffff88812c4079c0 EFLAGS: 00000246 + RAX: 1ffffffff083c7fe RBX: ffff888100042dc0 RCX: 0000000000000218 + RDX: 00000000ffffffff RSI: 0000000000000dc0 RDI: ffff888100042dc0 + RBP: ffff88812c4079c8 R08: ffffffffa0289f96 R09: ffffed1025880ea9 + R10: ffff888138839f80 R11: 0000000000000002 R12: 0000000000000dc0 + R13: 0000000000000100 R14: 000000000000008c R15: ffff8881271fc450 + ? cmd_exec+0x796/0x2200 [mlx5_core] + kmalloc_trace+0x26/0xc0 + cmd_exec+0x796/0x2200 [mlx5_core] + mlx5_cmd_do+0x22/0xc0 [mlx5_core] + mlx5_cmd_exec+0x17/0x30 [mlx5_core] + mlx5_core_modify_cq_moderation+0x139/0x1b0 [mlx5_core] + ? mlx5_add_cq_to_tasklet+0x280/0x280 [mlx5_core] + ? lockdep_set_lock_cmp_fn+0x190/0x190 + ? process_one_work+0x659/0x1220 + mlx5e_rx_dim_work+0x9d/0x100 [mlx5_core] + process_one_work+0x730/0x1220 + ? lockdep_hardirqs_on_prepare+0x400/0x400 + ? max_active_store+0xf0/0xf0 + ? assign_work+0x168/0x240 + worker_thread+0x70f/0x12d0 + ? __kthread_parkme+0xd1/0x1d0 + ? process_one_work+0x1220/0x1220 + kthread+0x2d9/0x3b0 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x2d/0x70 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork_asm+0x11/0x20 + + Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_ib ib_uverbs ib_core zram zsmalloc mlx5_core fuse + ---[ end trace 0000000000000000 ]--- + +Fixes: 3178308ad4ca ("net/mlx5e: Make tx_port_ts logic resilient to out-of-order CQEs") +Signed-off-by: Rahul Rameshbabu +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Link: https://lore.kernel.org/r/20231114215846.5902-11-saeed@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -399,9 +399,9 @@ mlx5e_txwqe_complete(struct mlx5e_txqsq + u8 metadata_index = be32_to_cpu(eseg->flow_table_metadata); + + mlx5e_skb_cb_hwtstamp_init(skb); +- mlx5e_ptpsq_track_metadata(sq->ptpsq, metadata_index); + mlx5e_ptp_metadata_map_put(&sq->ptpsq->metadata_map, skb, + metadata_index); ++ mlx5e_ptpsq_track_metadata(sq->ptpsq, metadata_index); + if (!netif_tx_queue_stopped(sq->txq) && + mlx5e_ptpsq_metadata_freelist_empty(sq->ptpsq)) { + netif_tx_stop_queue(sq->txq); diff --git a/queue-6.5/series b/queue-6.5/series index c5932e72e74..c855407cafd 100644 --- a/queue-6.5/series +++ b/queue-6.5/series @@ -481,3 +481,5 @@ drm-amd-display-enable-fast-plane-updates-on-dcn3.2-and-above.patch drm-amd-display-change-the-dmcub-mailbox-memory-location-from-fb-to-inbox.patch powerpc-powernv-fix-fortify-source-warnings-in-opal-prd.c.patch tracing-have-trace_event_file-have-ref-counters.patch +net-mlx5e-avoid-referencing-skb-after-free-ing-in-drop-path-of-mlx5e_sq_xmit_wqe.patch +net-mlx5e-track-xmit-submission-to-ptp-wq-after-populating-metadata-map.patch