1. 20 2月, 2020 1 次提交
  2. 18 2月, 2020 5 次提交
  3. 08 2月, 2020 4 次提交
  4. 01 2月, 2020 1 次提交
  5. 27 1月, 2020 1 次提交
  6. 25 1月, 2020 8 次提交
  7. 23 1月, 2020 1 次提交
    • I
      mlxsw: spectrum_acl: Fix use-after-free during reload · 971de2e5
      Ido Schimmel 提交于
      During reload (or module unload), the router block is de-initialized.
      Among other things, this results in the removal of a default multicast
      route from each active virtual router (VRF). These default routes are
      configured during initialization to trap packets to the CPU. In
      Spectrum-2, unlike Spectrum-1, multicast routes are implemented using
      ACL rules.
      
      Since the router block is de-initialized before the ACL block, it is
      possible that the ACL rules corresponding to the default routes are
      deleted while being accessed by the ACL delayed work that queries rules'
      activity from the device. This can result in a rare use-after-free [1].
      
      Fix this by protecting the rules list accessed by the delayed work with
      a lock. We cannot use a spinlock as the activity read operation is
      blocking.
      
      [1]
      [  123.331662] ==================================================================
      [  123.339920] BUG: KASAN: use-after-free in mlxsw_sp_acl_rule_activity_update_work+0x330/0x3b0
      [  123.349381] Read of size 8 at addr ffff8881f3bb4520 by task kworker/0:2/78
      [  123.357080]
      [  123.358773] CPU: 0 PID: 78 Comm: kworker/0:2 Not tainted 5.5.0-rc5-custom-33108-gf5df95d3ef41 #2209
      [  123.368898] Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018
      [  123.378456] Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work
      [  123.385970] Call Trace:
      [  123.388734]  dump_stack+0xc6/0x11e
      [  123.392568]  print_address_description.constprop.4+0x21/0x340
      [  123.403236]  __kasan_report.cold.8+0x76/0xb1
      [  123.414884]  kasan_report+0xe/0x20
      [  123.418716]  mlxsw_sp_acl_rule_activity_update_work+0x330/0x3b0
      [  123.444034]  process_one_work+0xb06/0x19a0
      [  123.453731]  worker_thread+0x91/0xe90
      [  123.467348]  kthread+0x348/0x410
      [  123.476847]  ret_from_fork+0x24/0x30
      [  123.480863]
      [  123.482545] Allocated by task 73:
      [  123.486273]  save_stack+0x19/0x80
      [  123.490000]  __kasan_kmalloc.constprop.6+0xc1/0xd0
      [  123.495379]  mlxsw_sp_acl_rule_create+0xa7/0x230
      [  123.500566]  mlxsw_sp2_mr_tcam_route_create+0xf6/0x3e0
      [  123.506334]  mlxsw_sp_mr_tcam_route_create+0x5b4/0x820
      [  123.512102]  mlxsw_sp_mr_table_create+0x3b5/0x690
      [  123.517389]  mlxsw_sp_vr_get+0x289/0x4d0
      [  123.521797]  mlxsw_sp_fib_node_get+0xa2/0x990
      [  123.526692]  mlxsw_sp_router_fib4_event_work+0x54c/0x2d60
      [  123.532752]  process_one_work+0xb06/0x19a0
      [  123.537352]  worker_thread+0x91/0xe90
      [  123.541471]  kthread+0x348/0x410
      [  123.545103]  ret_from_fork+0x24/0x30
      [  123.549113]
      [  123.550795] Freed by task 518:
      [  123.554231]  save_stack+0x19/0x80
      [  123.557958]  __kasan_slab_free+0x125/0x170
      [  123.562556]  kfree+0xd7/0x3a0
      [  123.565895]  mlxsw_sp_acl_rule_destroy+0x63/0xd0
      [  123.571081]  mlxsw_sp2_mr_tcam_route_destroy+0xd5/0x130
      [  123.576946]  mlxsw_sp_mr_tcam_route_destroy+0xba/0x260
      [  123.582714]  mlxsw_sp_mr_table_destroy+0x1ab/0x290
      [  123.588091]  mlxsw_sp_vr_put+0x1db/0x350
      [  123.592496]  mlxsw_sp_fib_node_put+0x298/0x4c0
      [  123.597486]  mlxsw_sp_vr_fib_flush+0x15b/0x360
      [  123.602476]  mlxsw_sp_router_fib_flush+0xba/0x470
      [  123.607756]  mlxsw_sp_vrs_fini+0xaa/0x120
      [  123.612260]  mlxsw_sp_router_fini+0x137/0x384
      [  123.617152]  mlxsw_sp_fini+0x30a/0x4a0
      [  123.621374]  mlxsw_core_bus_device_unregister+0x159/0x600
      [  123.627435]  mlxsw_devlink_core_bus_device_reload_down+0x7e/0xb0
      [  123.634176]  devlink_reload+0xb4/0x380
      [  123.638391]  devlink_nl_cmd_reload+0x610/0x700
      [  123.643382]  genl_rcv_msg+0x6a8/0xdc0
      [  123.647497]  netlink_rcv_skb+0x134/0x3a0
      [  123.651904]  genl_rcv+0x29/0x40
      [  123.655436]  netlink_unicast+0x4d4/0x700
      [  123.659843]  netlink_sendmsg+0x7c0/0xc70
      [  123.664251]  __sys_sendto+0x265/0x3c0
      [  123.668367]  __x64_sys_sendto+0xe2/0x1b0
      [  123.672773]  do_syscall_64+0xa0/0x530
      [  123.676892]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  123.682552]
      [  123.684238] The buggy address belongs to the object at ffff8881f3bb4500
      [  123.684238]  which belongs to the cache kmalloc-128 of size 128
      [  123.698261] The buggy address is located 32 bytes inside of
      [  123.698261]  128-byte region [ffff8881f3bb4500, ffff8881f3bb4580)
      [  123.711303] The buggy address belongs to the page:
      [  123.716682] page:ffffea0007ceed00 refcount:1 mapcount:0 mapping:ffff888236403500 index:0x0
      [  123.725958] raw: 0200000000000200 dead000000000100 dead000000000122 ffff888236403500
      [  123.734646] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
      [  123.743315] page dumped because: kasan: bad access detected
      [  123.749562]
      [  123.751241] Memory state around the buggy address:
      [  123.756620]  ffff8881f3bb4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  123.764716]  ffff8881f3bb4480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  123.772812] >ffff8881f3bb4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      [  123.780904]                                ^
      [  123.785697]  ffff8881f3bb4580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [  123.793793]  ffff8881f3bb4600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [  123.801883] ==================================================================
      
      Fixes: cf7221a4 ("mlxsw: spectrum_router: Add Multicast routing support for Spectrum-2")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      971de2e5
  8. 20 1月, 2020 4 次提交
  9. 19 1月, 2020 8 次提交
  10. 15 1月, 2020 7 次提交
    • P
      mlxsw: spectrum_qdisc: Include MC TCs in Qdisc counters · 85005b82
      Petr Machata 提交于
      mlxsw configures Spectrum in such a way that BUM traffic is passed not
      through its nominal traffic class TC, but through its MC counterpart TC+8.
      However, when collecting statistics, Qdiscs only look at the nominal TC and
      ignore the MC TC.
      
      Add two helpers to compute the value for logical TC from the constituents,
      one for backlog, the other for tail drops. Use them throughout instead of
      going through the xstats pointer directly.
      
      Counters for TX bytes and packets are deduced from packet priority
      counters, and therefore already include BUM traffic. wred_drop counter is
      irrelevant on MC TCs, because RED is not enabled on them.
      
      Fixes: 7b819530 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports")
      Signed-off-by: NPetr Machata <petrm@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      85005b82
    • P
      mlxsw: spectrum: Wipe xstats.backlog of down ports · ca7609ff
      Petr Machata 提交于
      Per-port counter cache used by Qdiscs is updated periodically, unless the
      port is down. The fact that the cache is not updated for down ports is no
      problem for most counters, which are relative in nature. However, backlog
      is absolute in nature, and if there is a non-zero value in the cache around
      the time that the port goes down, that value just stays there. This value
      then leaks to offloaded Qdiscs that report non-zero backlog even if
      there (obviously) is no traffic.
      
      The HW does not keep backlog of a downed port, so do likewise: as the port
      goes down, wipe the backlog value from xstats.
      
      Fixes: 075ab8ad ("mlxsw: spectrum: Collect tclass related stats periodically")
      Signed-off-by: NPetr Machata <petrm@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ca7609ff
    • I
      mlxsw: switchx2: Do not modify cloned SKBs during xmit · 63963d0f
      Ido Schimmel 提交于
      The driver needs to prepend a Tx header to each packet it is
      transmitting. The header includes information such as the egress port
      and traffic class.
      
      The addition of the header requires the driver to modify the SKB's
      header and therefore it must not be shared. Otherwise, we risk hitting
      various race conditions.
      
      For example, when a packet is flooded (cloned) by the bridge driver to
      two switch ports swp1 and swp2:
      
      t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with
           swp1's port number
      t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with
           swp2's port number, overwriting swp1's port number
      t2 - The device processes data buffer from t0. Packet is transmitted via
           swp2
      t3 - The device processes data buffer from t1. Packet is transmitted via
           swp2
      
      Usually, the device is fast enough and transmits the packet before its
      Tx header is overwritten, but this is not the case in emulated
      environments.
      
      Fix this by making sure the SKB's header is writable by calling
      skb_cow_head(). Since the function ensures we have headroom to push the
      Tx header, the check further in the function can be removed.
      
      v2:
      * Use skb_cow_head() instead of skb_unshare() as suggested by Jakub
      * Remove unnecessary check regarding headroom
      
      Fixes: 31557f0f ("mlxsw: Introduce Mellanox SwitchX-2 ASIC support")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reported-by: NShalom Toledo <shalomt@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      63963d0f
    • I
      mlxsw: spectrum: Do not modify cloned SKBs during xmit · 2da51ce7
      Ido Schimmel 提交于
      The driver needs to prepend a Tx header to each packet it is
      transmitting. The header includes information such as the egress port
      and traffic class.
      
      The addition of the header requires the driver to modify the SKB's
      header and therefore it must not be shared. Otherwise, we risk hitting
      various race conditions.
      
      For example, when a packet is flooded (cloned) by the bridge driver to
      two switch ports swp1 and swp2:
      
      t0 - mlxsw_sp_port_xmit() is called for swp1. Tx header is prepended with
           swp1's port number
      t1 - mlxsw_sp_port_xmit() is called for swp2. Tx header is prepended with
           swp2's port number, overwriting swp1's port number
      t2 - The device processes data buffer from t0. Packet is transmitted via
           swp2
      t3 - The device processes data buffer from t1. Packet is transmitted via
           swp2
      
      Usually, the device is fast enough and transmits the packet before its
      Tx header is overwritten, but this is not the case in emulated
      environments.
      
      Fix this by making sure the SKB's header is writable by calling
      skb_cow_head(). Since the function ensures we have headroom to push the
      Tx header, the check further in the function can be removed.
      
      v2:
      * Use skb_cow_head() instead of skb_unshare() as suggested by Jakub
      * Remove unnecessary check regarding headroom
      
      Fixes: 56ade8fe ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Reported-by: NShalom Toledo <shalomt@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2da51ce7
    • I
      mlxsw: spectrum: Do not enforce same firmware version for multiple ASICs · d58c35ca
      Ido Schimmel 提交于
      In commit a72afb68 ("mlxsw: Enforce firmware version for
      Spectrum-2") I added a required firmware version for Spectrum-2, but
      missed the fact that mlxsw_sp2_init() is used by both Spectrum-2 and
      Spectrum-3. This means that the same firmware version will be used for
      both, which is wrong.
      
      Fix this by creating a new init() callback for Spectrum-3.
      
      Fixes: a72afb68 ("mlxsw: Enforce firmware version for Spectrum-2")
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Tested-by: NShalom Toledo <shalomt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d58c35ca
    • I
      mlxsw: spectrum_router: Set hardware flags for routes · ee5a0448
      Ido Schimmel 提交于
      Previous patches added support for two hardware flags for IPv4 and IPv6
      routes: 'RTM_F_OFFLOAD' and 'RTM_F_TRAP'. Both indicate the presence of
      the route in hardware. The first indicates that traffic is actually
      offloaded from the kernel, whereas the second indicates that packets
      hitting such routes are trapped to the kernel for processing (e.g., host
      routes).
      
      Use these two flags in mlxsw. The flags are modified in two places.
      Firstly, whenever a route is updated in the device's table. This
      includes the addition, deletion or update of a route. For example, when
      a host route is promoted to perform NVE decapsulation, its action in the
      device is updated, the 'RTM_F_OFFLOAD' flag set and the 'RTM_F_TRAP'
      flag cleared.
      
      Secondly, when a route is replaced and overwritten by another route, its
      flags are cleared.
      
      v2:
      * Convert to new fib_alias_hw_flags_set() interface
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ee5a0448
    • I
      mlxsw: spectrum_router: Separate nexthop offload indication from route · 8c5a5b9b
      Ido Schimmel 提交于
      The driver currently uses the 'RTNH_F_OFFLOAD' flag for both routes and
      nexthops, which is cumbersome and unnecessary now that we have separate
      flag for the route itself.
      
      Separate the offload indication for nexthops from routes and call it
      whenever the offload state within the nexthop group changes.
      
      Note that IPv6 (unlike IPv4) does not share the same nexthop group
      between different routes, whereas mlxsw does. Therefore, whenever the
      offload indication within an IPv6 nexthop group changes, all the linked
      routes need to be updated.
      Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8c5a5b9b