• Raed Salem's avatar
    net/mlx5e: Fix slab-out-of-bounds in mlx5e_rep_is_lag_netdev · 21083309
    Raed Salem authored
    mlx5e_rep_is_lag_netdev is used as first check as part of netdev events
    handler for bond device of non-uplink representors, this handler can get
    any netdevice under the same network namespace of mlx5e netdevice. Current
    code treats the netdev as mlx5e netdev and only later on verifies this,
    hence causes the following Kasan trace:
    [15402.744990] ==================================================================
    [15402.746942] BUG: KASAN: slab-out-of-bounds in mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
    [15402.749009] Read of size 8 at addr ffff880391f3f6b0 by task ovs-vswitchd/5347
    
    [15402.752065] CPU: 7 PID: 5347 Comm: ovs-vswitchd Kdump: loaded Tainted: G    B      O     --------- -t - 4.18.0-g3dcc204d291d-dirty #1
    [15402.755349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
    [15402.757600] Call Trace:
    [15402.758968]  dump_stack+0x71/0xab
    [15402.760427]  print_address_description+0x6a/0x270
    [15402.761969]  kasan_report+0x179/0x2d0
    [15402.763445]  ? mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
    [15402.765121]  mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
    [15402.766782]  mlx5e_rep_esw_bond_netevent+0x129/0x620 [mlx5_core]
    
    Fix by deferring the violating access to be post the netdev verify check.
    
    Fixes: 7e51891a ("net/mlx5e: Use netdev events to set/del egress acl forward-to-vport rule")
    Signed-off-by: default avatarRaed Salem <raeds@mellanox.com>
    Reviewed-by: default avatarRoi Dayan <roid@mellanox.com>
    Reviewed-by: default avatarVu Pham <vuhuong@mellanox.com>
    Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
    21083309
bond.c 9.76 KB