1. 15 11月, 2020 10 次提交
  2. 13 11月, 2020 14 次提交
  3. 04 11月, 2020 1 次提交
  4. 29 9月, 2020 1 次提交
  5. 22 9月, 2020 1 次提交
  6. 24 8月, 2020 1 次提交
  7. 30 7月, 2020 2 次提交
    • I
      mlxsw: spectrum_router: Fix use-after-free in router init / de-init · 5515c344
      Ido Schimmel 提交于
      Several notifiers are registered as part of router initialization.
      Since some of these notifiers are registered before the end of the
      initialization, it is possible for them to access uninitialized or freed
      memory when processing notifications [1].
      
      Additionally, some of these notifiers queue work items on a workqueue.
      If these work items are executed after the router was de-initialized,
      they will access freed memory.
      
      Fix both problems by moving the registration of the notifiers to the end
      of the router initialization and flush the work queue after they are
      unregistered.
      
      [1]
      BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:938 [inline]
      BUG: KASAN: use-after-free in __mutex_lock+0xeea/0x1340 kernel/locking/mutex.c:1103
      Read of size 8 at addr ffff888038c3a6e0 by task kworker/u4:1/61
      
      CPU: 1 PID: 61 Comm: kworker/u4:1 Not tainted 5.8.0-rc2+ #36
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      Workqueue: mlxsw_core_ordered mlxsw_sp_inet6addr_event_work
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0xf6/0x16e lib/dump_stack.c:118
       print_address_description.constprop.0+0x1c/0x250 mm/kasan/report.c:383
       __kasan_report mm/kasan/report.c:513 [inline]
       kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
       __mutex_lock_common kernel/locking/mutex.c:938 [inline]
       __mutex_lock+0xeea/0x1340 kernel/locking/mutex.c:1103
       mlxsw_sp_inet6addr_event_work+0xb3/0x1b0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7123
       process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269
       worker_thread+0x9e/0x1050 kernel/workqueue.c:2415
       kthread+0x355/0x470 kernel/kthread.c:291
       ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
      
      Allocated by task 1298:
       save_stack+0x1b/0x40 mm/kasan/common.c:48
       set_track mm/kasan/common.c:56 [inline]
       __kasan_kmalloc mm/kasan/common.c:494 [inline]
       __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467
       kmalloc include/linux/slab.h:555 [inline]
       kzalloc include/linux/slab.h:669 [inline]
       mlxsw_sp_router_init+0xb2/0x1d20 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:8074
       mlxsw_sp_init+0xbd8/0x3ac0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2932
       __mlxsw_core_bus_device_register+0x657/0x10d0 drivers/net/ethernet/mellanox/mlxsw/core.c:1375
       mlxsw_core_bus_device_register drivers/net/ethernet/mellanox/mlxsw/core.c:1436 [inline]
       mlxsw_devlink_core_bus_device_reload_up+0xcd/0x150 drivers/net/ethernet/mellanox/mlxsw/core.c:1133
       devlink_reload net/core/devlink.c:2959 [inline]
       devlink_reload+0x281/0x3b0 net/core/devlink.c:2944
       devlink_nl_cmd_reload+0x2f1/0x7c0 net/core/devlink.c:2987
       genl_family_rcv_msg_doit net/netlink/genetlink.c:691 [inline]
       genl_family_rcv_msg net/netlink/genetlink.c:736 [inline]
       genl_rcv_msg+0x611/0x9d0 net/netlink/genetlink.c:753
       netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2469
       genl_rcv+0x24/0x40 net/netlink/genetlink.c:764
       netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
       netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1329
       netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1918
       sock_sendmsg_nosec net/socket.c:652 [inline]
       sock_sendmsg+0x150/0x190 net/socket.c:672
       ____sys_sendmsg+0x6d8/0x840 net/socket.c:2363
       ___sys_sendmsg+0xff/0x170 net/socket.c:2417
       __sys_sendmsg+0xe5/0x1b0 net/socket.c:2450
       do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Freed by task 1348:
       save_stack+0x1b/0x40 mm/kasan/common.c:48
       set_track mm/kasan/common.c:56 [inline]
       kasan_set_free_info mm/kasan/common.c:316 [inline]
       __kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455
       slab_free_hook mm/slub.c:1474 [inline]
       slab_free_freelist_hook mm/slub.c:1507 [inline]
       slab_free mm/slub.c:3072 [inline]
       kfree+0xe6/0x320 mm/slub.c:4063
       mlxsw_sp_fini+0x340/0x4e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3132
       mlxsw_core_bus_device_unregister+0x16c/0x6d0 drivers/net/ethernet/mellanox/mlxsw/core.c:1474
       mlxsw_devlink_core_bus_device_reload_down+0x8e/0xc0 drivers/net/ethernet/mellanox/mlxsw/core.c:1123
       devlink_reload+0xc6/0x3b0 net/core/devlink.c:2952
       devlink_nl_cmd_reload+0x2f1/0x7c0 net/core/devlink.c:2987
       genl_family_rcv_msg_doit net/netlink/genetlink.c:691 [inline]
       genl_family_rcv_msg net/netlink/genetlink.c:736 [inline]
       genl_rcv_msg+0x611/0x9d0 net/netlink/genetlink.c:753
       netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2469
       genl_rcv+0x24/0x40 net/netlink/genetlink.c:764
       netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
       netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1329
       netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1918
       sock_sendmsg_nosec net/socket.c:652 [inline]
       sock_sendmsg+0x150/0x190 net/socket.c:672
       ____sys_sendmsg+0x6d8/0x840 net/socket.c:2363
       ___sys_sendmsg+0xff/0x170 net/socket.c:2417
       __sys_sendmsg+0xe5/0x1b0 net/socket.c:2450
       do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      The buggy address belongs to the object at ffff888038c3a000
       which belongs to the cache kmalloc-2k of size 2048
      The buggy address is located 1760 bytes inside of
       2048-byte region [ffff888038c3a000, ffff888038c3a800)
      The buggy address belongs to the page:
      page:ffffea0000e30e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea0000e30e00 order:3 compound_mapcount:0 compound_pincount:0
      flags: 0x100000000010200(slab|head)
      raw: 0100000000010200 dead000000000100 dead000000000122 ffff88806c40c000
      raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff888038c3a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff888038c3a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      >ffff888038c3a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
       ffff888038c3a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
       ffff888038c3a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      
      Fixes: 965fa8e6 ("mlxsw: spectrum_router: Make RIF deletion more robust")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      5515c344
    • I
      mlxsw: spectrum_router: Allow programming link-local host routes · 89ab5331
      Ido Schimmel 提交于
      Cited commit added the ability to program link-local prefix routes to
      the ASIC so that relevant packets are routed and trapped correctly.
      
      However, host routes were not included in the change and thus not
      programmed to the ASIC. This can result in packets being trapped via an
      external route trap instead of a local route trap as in IPv4.
      
      Fix this by programming all the link-local routes to the ASIC.
      
      Fixes: 10d3757f ("mlxsw: spectrum_router: Allow programming link-local prefix routes")
      Reported-by: NAlex Veber <alexve@mellanox.com>
      Tested-by: NAlex Veber <alexve@mellanox.com>
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      89ab5331
  8. 11 7月, 2020 1 次提交
    • I
      mlxsw: spectrum_router: Remove inappropriate usage of WARN_ON() · d9d54202
      Ido Schimmel 提交于
      We should not trigger a warning when a memory allocation fails. Remove
      the WARN_ON().
      
      The warning is constantly triggered by syzkaller when it is injecting
      faults:
      
      [ 2230.758664] FAULT_INJECTION: forcing a failure.
      [ 2230.758664] name failslab, interval 1, probability 0, space 0, times 0
      [ 2230.762329] CPU: 3 PID: 1407 Comm: syz-executor.0 Not tainted 5.8.0-rc2+ #28
      ...
      [ 2230.898175] WARNING: CPU: 3 PID: 1407 at drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:6265 mlxsw_sp_router_fib_event+0xfad/0x13e0
      [ 2230.898179] Kernel panic - not syncing: panic_on_warn set ...
      [ 2230.898183] CPU: 3 PID: 1407 Comm: syz-executor.0 Not tainted 5.8.0-rc2+ #28
      [ 2230.898190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      
      Fixes: 3057224e ("mlxsw: spectrum_router: Implement FIB offload in deferred work")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d9d54202
  9. 28 5月, 2020 1 次提交
  10. 27 5月, 2020 1 次提交
    • I
      mlxsw: spectrum_router: Allow programming link-local prefix routes · 10d3757f
      Ido Schimmel 提交于
      The device has a trap for IPv6 packets that need be routed and have a
      unicast link-local destination IP (i.e., fe80::/10). This allows mlxsw
      to ignore link-local routes, as the packets will be trapped to the CPU
      in any case.
      
      However, since link-local routes are not programmed, it is possible for
      routed packets to hit the default route which might also be programmed
      to trap packets. This means that packets with a link-local destination
      IP might be trapped for the wrong reason.
      
      To overcome this, allow programming link-local prefix routes (usually
      one fe80::/64 per-table), so that the packets will be forwarded until
      reaching the link-local trap.
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      10d3757f
  11. 21 4月, 2020 1 次提交
  12. 28 3月, 2020 3 次提交
    • I
      mlxsw: spectrum_router: Avoid uninitialized symbol errors · a84acf78
      Ido Schimmel 提交于
      Suppress the following smatch errors. None of these are actually
      possible with current code paths.
      
      drivers/net/ethernet/mellanox/mlxsw//spectrum_router.c:1220
      mlxsw_sp_ipip_entry_find_decap() error: uninitialized symbol 'saddrp'.
      drivers/net/ethernet/mellanox/mlxsw//spectrum_router.c:1220
      mlxsw_sp_ipip_entry_find_decap() error: uninitialized symbol
      'saddr_len'.
      drivers/net/ethernet/mellanox/mlxsw//spectrum_router.c:1221
      mlxsw_sp_ipip_entry_find_decap() error: uninitialized symbol
      'saddr_prefix_len'.
      
      drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:1390
      mlxsw_sp_netdevice_ipip_ol_reg_event() error: uninitialized symbol
      'ipipt'.
      
      drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:3255
      mlxsw_sp_nexthop_group_update() error: uninitialized symbol 'err'.
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a84acf78
    • I
      mlxsw: spectrum: Remove unused RIF and FID families · bdb373cf
      Ido Schimmel 提交于
      In merge commit 50853808 ("Merge branch
      'mlxsw-Prepare-for-VLAN-aware-bridge-w-VxLAN'") I flipped mlxsw to use
      emulated 802.1Q FIDs and correspondingly emulated VLAN RIFs. This means
      that the non-emulated variants are no longer used. Remove them and
      suppress the following warnings when compiling with W=1:
      
      drivers/net/ethernet/mellanox/mlxsw//spectrum_router.c:7572:38: warning:
      ‘mlxsw_sp_rif_vlan_ops’ defined but not used [-Wunused-const-variable=]
      
      drivers/net/ethernet/mellanox/mlxsw//spectrum_fid.c:584:41: warning:
      ‘mlxsw_sp_fid_8021q_family’ defined but not used
      [-Wunused-const-variable=]
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      bdb373cf
    • I
      mlxsw: spectrum_router: Add proper function documentation · f0a66984
      Ido Schimmel 提交于
      Suppress following warnings when compiling with W=1:
      
      drivers/net/ethernet/mellanox/mlxsw//spectrum_router.c:1552: warning:
      Function parameter or member 'mlxsw_sp' not described in
      '__mlxsw_sp_ipip_entry_update_tunnel'
      drivers/net/ethernet/mellanox/mlxsw//spectrum_router.c:1552: warning:
      Function parameter or member 'ipip_entry' not described in
      '__mlxsw_sp_ipip_entry_update_tunnel'
      drivers/net/ethernet/mellanox/mlxsw//spectrum_router.c:1552: warning:
      Function parameter or member 'extack' not described in
      '__mlxsw_sp_ipip_entry_update_tunnel'
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f0a66984
  13. 23 2月, 2020 3 次提交