From patchwork Mon Jun 19 17:49:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: William Tu X-Patchwork-Id: 1796776 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=Nvidia.com header.i=@Nvidia.com header.a=rsa-sha256 header.s=selector2 header.b=EffbFOfz; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4QlHP11x3bz20Wk for ; Tue, 20 Jun 2023 03:50:45 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1qBJ1Q-0008Ed-Rl; Mon, 19 Jun 2023 17:50:36 +0000 Received: from mail-bn8nam12on2043.outbound.protection.outlook.com ([40.107.237.43] helo=NAM12-BN8-obe.outbound.protection.outlook.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1qBJ1F-0007xk-6u for kernel-team@lists.ubuntu.com; Mon, 19 Jun 2023 17:50:25 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TxJCABd/W19xf3J+7KNoRn58zaG9UUpUVFDdv8gXDEBOZgZE6xwmgHUuCn7vE46XaNSNMgzkvsnUzNwvOKXm+eLrG0qkgX4ynqPy6p37walWSQ81AZ6pvSrE/tsnXEA1ZzkpmsoM4i0xDWbKo7TNUN4x4Uz7UYjCsSeW+hHdzSGlzBRngzvfP1SABHbmhjX+OK0/modiB6a1ejru5TXQEqnbA0y/tO6BJw/sytnDg2zj1wyb91w6Vq9+nsZ82Jk3+E6wn3hS4NKuzPNF7p72vvzfodjJYKCkNryF7Bb857/gcpYq4H16Ki42jGA56AKSbZ+ctNLEzg0vtb84ujoDfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jE8iIm6TBNrOJcGL5pvFd8wNVTBJ9ZarCH+i+4OkzxY=; b=dIh0As1fw8DWRvL7RCEfa9kj/UZR7+Jz8U4sa2SrlXbHA9xQzJun7Emo19ApVQfL6g1mJCG+2RGEnmfDTBo6yAnXrB2VLTr57+9TUY7G/JkpxP7bllsPWTc90qUzilv+Av1TGKkASA3+Jt0YLnUDO+Yp3EPsPZNCCz/DFR7nkVD6LhJcMuXzBshJekj3IN2ETjX99x3trUv19OBoG+HSVLtrE0Dg20XtczwHGIMBcrg0A4Ho1iaDMmZSRCKjfY9iP4eUoeE9JLWDLYDRzw60IPF7+IjDb2g74Gl3h2CCwa3xy2yw1mJAfzU7DgR3RzmLdmSOea+SXe2+mjKjECKo8A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=canonical.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jE8iIm6TBNrOJcGL5pvFd8wNVTBJ9ZarCH+i+4OkzxY=; b=EffbFOfzjnFfjPw0NH/D2wQveLsDu6blIR1hG52wTGtiRX6TKyVpeQsX8iw62s3A8yCxF+nhja+y1yxgETygnAZhG+zliECnAUKZZ5r3SBtI76JWPP1fNXhF6slEgoefkpD3RvnTm21RIcV/TdWSismPaLIf9Tq2OPVKtaYIco/j0KKuBA+64ctBhU1kYULM7aqd6kuoYrMSMJVd3WouiGDSn/QEpLKXm9JKhqgaILHGcoQDs1DGFjNn3WxaVOy5lVQjBocy30u6IGhoZWgiSCBYOUxDAK3NylnklAQHqumulzfBvKe1qja0GFY1zyLceUIWJ1SeAr6ONN3U+NBHZA== Received: from DM6PR17CA0016.namprd17.prod.outlook.com (2603:10b6:5:1b3::29) by CH2PR12MB4135.namprd12.prod.outlook.com (2603:10b6:610:7c::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6500.37; Mon, 19 Jun 2023 17:50:21 +0000 Received: from CY4PEPF0000EDD3.namprd03.prod.outlook.com (2603:10b6:5:1b3:cafe::b) by DM6PR17CA0016.outlook.office365.com (2603:10b6:5:1b3::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6500.37 via Frontend Transport; Mon, 19 Jun 2023 17:50:21 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by CY4PEPF0000EDD3.mail.protection.outlook.com (10.167.241.207) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6521.20 via Frontend Transport; Mon, 19 Jun 2023 17:50:21 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.5; Mon, 19 Jun 2023 10:50:12 -0700 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.37; Mon, 19 Jun 2023 10:50:11 -0700 Received: from mtl123.mtl.labs.mlnx (10.127.8.10) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.37 via Frontend Transport; Mon, 19 Jun 2023 10:50:11 -0700 Received: from sw-mtx-002.mtx.labs.mlnx (sw-mtx-002.mtx.labs.mlnx [10.9.151.106]) by mtl123.mtl.labs.mlnx (8.14.4/8.14.4) with ESMTP id 35JHnnvO030853; Mon, 19 Jun 2023 20:50:08 +0300 From: William Tu To: Subject: [SRU][J:linux-bluefield][PATCH v4 09/10] net/sched: clear actions pointer in miss cookie init fail Date: Mon, 19 Jun 2023 20:49:40 +0300 Message-ID: <20230619174942.1195846-10-witu@nvidia.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230619174942.1195846-1-witu@nvidia.com> References: <20230619174942.1195846-1-witu@nvidia.com> MIME-Version: 1.0 X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EDD3:EE_|CH2PR12MB4135:EE_ X-MS-Office365-Filtering-Correlation-Id: 7a215e55-45f5-4278-4e19-08db70eda708 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 12DGZ75+nV30zhb+6yRjG7xi8AL6qm5eUf+V9PSsnQgUMnI8eGwY6bI/pQSVEisZhFMKUC8LB+fZmS9/A5J+c4PY9PE8/KUViYv9S7LDWdVmzVKnwIY4HscAL5hPxkg99LHPTqQqxXWuJDm3Uoyb9ZugpIKHoWkJ/rBEQMJj+VmkD7nRIZFEPMYKQWAHcLMGpGF7TYMfyxWWspW5ps1aETHr9XT1j3iEMMKCzQU2v1jEh1jDc7Vw2qP+IOIljEAHROThX7/2f8RHt4Y2Ka41KQendd7TiXA4IwMbTmrChedZso4Lj1VviLmIuJ8eqBZBESiN7e6TiF7UXgj9j95PYFNdcDHUb5I66ENh63fTsqD0fCRtTVZiNfweRunpwvUWFDCWybhQp06UTeD/vUD1D4esI+V0ILdRjZULmgPquayXk/Nquvu//g3L9ag2z8SWf0D97xk1SpuW3TL6I63jpdt5/oVPollrwCb6E161sTcMhOBJEM6Us6sxJ0exa7u15o0Au4V/dTIMfgmS7nzGjn8jbIep0D+IGwL2Dd/OptjFec3i8Rn0eDcHi0aEL3u2mfI2C6WYKEstGGyVNevfk4Ev17zShEpd7V13y94xTIiEUa9HGHpu4AqmPVwhD+g2gZn5W3XxHtBD9XRF/oqmhRTq5lPonrQ1O4oYPUpsRo2TO7jSgQntTuymiDQ4uVs6ko32dW5382aMOuI6yYwed6frAiQPa/nTbA7Btu61qXS8YpMa3RlcOOaR5YbvLVRux/9VTud9zgnn/AyWo9MlTMLoQT9EWv+EFSLvUXPArit6F9EAuRSZivah7xBZo/5C X-Forefront-Antispam-Report: CIP:216.228.117.160; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:dc6edge1.nvidia.com; CAT:NONE; SFS:(13230028)(4636009)(136003)(346002)(39860400002)(396003)(376002)(451199021)(40470700004)(46966006)(36840700001)(186003)(107886003)(40460700003)(26005)(1076003)(82740400003)(36860700001)(2616005)(40480700001)(47076005)(7636003)(356005)(336012)(83380400001)(82310400005)(478600001)(4326008)(41300700001)(6916009)(70206006)(70586007)(8676002)(36756003)(316002)(8936002)(54906003)(966005)(86362001)(6666004)(2906002)(5660300002); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jun 2023 17:50:21.3862 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 7a215e55-45f5-4278-4e19-08db70eda708 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.117.160]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EDD3.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB4135 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: dann.frazier@canonical.com, paulb@nvidia.com, vlad@nvidia.com, yifeid@nvidia.com, bodong@nvidia.com Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pedro Tammela BugLink: https://bugs.launchpad.net/bugs/2012571 Palash reports a UAF when using a modified version of syzkaller[1]. When 'tcf_exts_miss_cookie_base_alloc()' fails in 'tcf_exts_init_ex()' a call to 'tcf_exts_destroy()' is made to free up the tcf_exts resources. In flower, a call to '__fl_put()' when 'tcf_exts_init_ex()' fails is made; Then calling 'tcf_exts_destroy()', which triggers an UAF since the already freed tcf_exts action pointer is lingering in the struct. Before the offending patch, this was not an issue since there was no case where the tcf_exts action pointer could linger. Therefore, restore the old semantic by clearing the action pointer in case of a failure to initialize the miss_cookie. [1] https://github.com/cmu-pasta/linux-kernel-enriched-corpus v1->v2: Fix compilation on configs without tc actions (kernel test robot) Fixes: 80cd22c35c90 ("net/sched: cls_api: Support hardware miss to tc action") Reported-by: Palash Oswal Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller (cherry picked from commit 338469d677e5d426f5ada88761f16f6d2c7c1981) Signed-off-by: William Tu --- net/sched/cls_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 9848eb41ec08..c5b2a45abe18 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -3202,6 +3202,9 @@ int tcf_exts_init_ex(struct tcf_exts *exts, struct net *net, int action, err_miss_alloc: tcf_exts_destroy(exts); +#ifdef CONFIG_NET_CLS_ACT + exts->actions = NULL; +#endif return err; } EXPORT_SYMBOL(tcf_exts_init_ex);