Received-SPF: pass (google.com: domain of linux-kernel+bounces-13849-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: "Pucha, HimasekharX Reddy" <himasekharx.reddy.pucha@intel.com>
To: Ke Xiao <xiaoke@sangfor.com.cn>, "Brandeburg, Jesse"
	<jesse.brandeburg@intel.com>, "Nguyen, Anthony L"
	<anthony.l.nguyen@intel.com>, "davem@davemloft.net" <davem@davemloft.net>,
	"edumazet@google.com" <edumazet@google.com>, "kuba@kernel.org"
	<kuba@kernel.org>, "pabeni@redhat.com" <pabeni@redhat.com>
CC: "Sokolowski, Jan" <jan.sokolowski@intel.com>, "netdev@vger.kernel.org"
	<netdev@vger.kernel.org>, "Ding, Hui" <dinghui@sangfor.com.cn>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"zhangrui182@huawei.com" <zhangrui182@huawei.com>,
	"intel-wired-lan@lists.osuosl.org" <intel-wired-lan@lists.osuosl.org>,
	"horms@kernel.org" <horms@kernel.org>, "zhudi2@huawei.com"
	<zhudi2@huawei.com>, "shannon.nelson@amd.com" <shannon.nelson@amd.com>
Subject: RE: [Intel-wired-lan] [net PATCH v2] i40e: fix use-after-free in
 i40e_aqc_add_filters()
Thread-Topic: [Intel-wired-lan] [net PATCH v2] i40e: fix use-after-free in
 i40e_aqc_add_filters()
Thread-Index: AQHaMc2F6YCwV6CYMkWIY3eM15pXvrDEz1wA
Date: Mon, 1 Jan 2024 10:06:28 +0000
Message-ID: <CYYPR11MB842957267FD31A099482DE96BD62A@CYYPR11MB8429.namprd11.prod.outlook.com>
References: <20231218070850.15870-1-xiaoke@sangfor.com.cn>
In-Reply-To: <20231218070850.15870-1-xiaoke@sangfor.com.cn>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?jR0v9ba41y+dt8tvYtaeyYur1Q1gqDvWarkC7Rh/+zIMVrC4GxUG2Huf5dHy?=
 =?us-ascii?Q?TcxowGARYdXAHpa7lgRFu3wF4vhC4gP1U5zmvHuILPtCdQJ8w1zwvCLEI79n?=
 =?us-ascii?Q?7EaDJRgqIkTYfne7E5/g+116hSpjfqqEs0JjUBW7fKs/aExaMtk8sv6q0qbI?=
 =?us-ascii?Q?2z8BcyvwUABMcBfiMspjLjaQlK2uv9EleLm7QSBsHC6N8evF6Kkp6KS1tM41?=
 =?us-ascii?Q?FJ34xL4XTnGq/IL+gS+cjV4O1mX5ktrgwGZBoUIzEBNp4zJxRDWTVMnY8Jh9?=
 =?us-ascii?Q?ApGUW+Wk346l/yZ5HN7ErQAQckLVygp33kU4aif1C1w34m0Al/f2v4vM8hZN?=
 =?us-ascii?Q?xds8i00WqeGcnOycFZfJH6RUVUL3beed/PG+vpQuTHoy43AFrOi9JSPAKUmG?=
 =?us-ascii?Q?5sAXGjqkBP6VtnK6OEFpy5QoekdItyob6/koqLQIN9/wpxIlHvZ8oceIXDTB?=
 =?us-ascii?Q?f5rVfA7BnxfWFV+IfhkVd1x+Ho884hzmRbuSQ9dH9iMIt8OpoFafelyTJb7Z?=
 =?us-ascii?Q?K8iP/MogjegYAnco3JakkH+Ddket0XLc+x5eUmloxyiTx7ljg1llom4FJ/X7?=
 =?us-ascii?Q?Yd9kcC0vLuF70hBMzwBy5Fa7s1R5CsNI3sfjTvQyHSXbY8dozH06AbPRSFBA?=
 =?us-ascii?Q?Fe2MiUE2PcPh1S+V6yqJhPd05t6U2jYiiwv+q35Oet/2mYQ6Xph4uqqQLymf?=
 =?us-ascii?Q?5yyjRZ32yPHDWtZfvE99eMUR8PQK2wAwS8sVOJ7bpO1etvjyJ0XI6mN4DT+E?=
 =?us-ascii?Q?e0UXFAwg0HuMJR4GComkmM1p31qX3XTcOZP0Ef6HkAkeXnZ9IhsK5LHqhDjV?=
 =?us-ascii?Q?NWXojPlDth301iAjihrzRoHZaJ72WK+Tdeut0UHTwGUxQHaHiLCDVsklIb40?=
 =?us-ascii?Q?dGqqbKNNdoPYrORqklveyk5V9Th/D2eLudTDEIcCYhKnNqlue1bgAfxuVXXs?=
 =?us-ascii?Q?0HzQn7lTxcLDVELMQM1P91gFFdwrF9nNdpTiE7QINcKb41pN6zcrYAGTx7s+?=
 =?us-ascii?Q?Pe1mYBgUkJd5LV8i730xlfFBCYGJGjwsTKMxZX1syMbdj/UBCzQEnVM+UUBe?=
 =?us-ascii?Q?fEBp5JaD6Uli3wO1E808tMl0jSwVFv5HKOWgsu2QyVz6BEk8YWfngv7QL9w/?=
 =?us-ascii?Q?dJe3SZO5QhkGSZ+IfA9SIJGckLgDTm6dtLatJr5IIV7GNo6HlKLwoycsG+zn?=
 =?us-ascii?Q?kISe7b7DLghhBowF3SoPDH0BopsWjpYqlSSvYZ2HFC96l0VJxKad8/PnCnBn?=
 =?us-ascii?Q?fW1n/jCP5mzfr42fdhNphdkILXAIh5ck/7YdDnGis7Th01UdvaszTlpt9w7t?=
 =?us-ascii?Q?2yXtUmUNWOME0ZUWy93g3TEOP4x/e/UJfJmg8OFl4ahBi2shnbxv52jTcspL?=
 =?us-ascii?Q?ikY/EtpnPTC8CCWeld1HX6x+SvnDWpNp9+50DAvDHDnLoeEjUor6F6Lnn5hg?=
 =?us-ascii?Q?fZBh5GlnUuHxqDDvGwKhiPWph06b9jI1nnMd2p0zvHJppDkz2nK3v69boekU?=
 =?us-ascii?Q?UGctmXhAkXwVWIjpwYkXmWDckXjFWbPu+M3beeNGILfh/uAGfufTL6G5EWE0?=
 =?us-ascii?Q?8hPkfuXci6pWwkVugkB17iqeRIyHMSyNfScdCx1TJw6jbjgPcEAhC3HrBkZI?=
 =?us-ascii?Q?Pw=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CYYPR11MB8429.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5a738c48-5889-4dd4-5d70-08dc0ab1520d
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Jan 2024 10:06:28.1700
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: nHbIDIVsosNX5YIXYJDjZqtsxUcu9SF2tx8xMgpXXOvoEufStaLHYwE7swm82yNR7rtXSxTHmfOg5WyRBQn83sUqkKhQ5ZNUwtSma1UVBbnIaEij6PlCRN/HjmPZLR/8
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB4965
X-OriginatorOrg: intel.com

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of K=
e Xiao
> Sent: Monday, December 18, 2023 12:39 PM
> To: Brandeburg, Jesse <jesse.brandeburg@intel.com>; Nguyen, Anthony L <an=
thony.l.nguyen@intel.com>; davem@davemloft.net; edumazet@google.com; kuba@k=
ernel.org; pabeni@redhat.com
> Cc: Sokolowski, Jan <jan.sokolowski@intel.com>; netdev@vger.kernel.org; D=
ing, Hui <dinghui@sangfor.com.cn>; linux-kernel@vger.kernel.org; zhangrui18=
2@huawei.com; intel-wired-lan@lists.osuosl.org; horms@kernel.org; zhudi2@hu=
awei.com; Ke Xiao <xiaoke@sangfor.com.cn>; shannon.nelson@amd.com
> Subject: [Intel-wired-lan] [net PATCH v2] i40e: fix use-after-free in i40=
e_aqc_add_filters()
>
> Commit 3116f59c12bd ("i40e: fix use-after-free in
> i40e_sync_filters_subtask()") avoided use-after-free issues,
> by increasing refcount during update the VSI filter list to
> the HW. However, it missed the unicast situation.
>
> When deleting an unicast FDB entry, the i40e driver will release
> the mac_filter, and i40e_service_task will concurrently request
> firmware to add the mac_filter, which will lead to the following
> use-after-free issue.
>
> Fix again for both netdev->uc and netdev->mc.
>
> BUG: KASAN: use-after-free in i40e_aqc_add_filters+0x55c/0x5b0 [i40e]
> Read of size 2 at addr ffff888eb3452d60 by task kworker/8:7/6379
>
> CPU: 8 PID: 6379 Comm: kworker/8:7 Kdump: loaded Tainted: G
> Workqueue: i40e i40e_service_task [i40e]
> Call Trace:
>  dump_stack+0x71/0xab
>  print_address_description+0x6b/0x290
>  kasan_report+0x14a/0x2b0
>  i40e_aqc_add_filters+0x55c/0x5b0 [i40e]
>  i40e_sync_vsi_filters+0x1676/0x39c0 [i40e]
>  i40e_service_task+0x1397/0x2bb0 [i40e]
>  process_one_work+0x56a/0x11f0
>  worker_thread+0x8f/0xf40
>  kthread+0x2a0/0x390
>  ret_from_fork+0x1f/0x40
>
> Allocated by task 21948:
>  kasan_kmalloc+0xa6/0xd0
>  kmem_cache_alloc_trace+0xdb/0x1c0
>  i40e_add_filter+0x11e/0x520 [i40e]
>  i40e_addr_sync+0x37/0x60 [i40e]
>  __hw_addr_sync_dev+0x1f5/0x2f0
>  i40e_set_rx_mode+0x61/0x1e0 [i40e]
>  dev_uc_add_excl+0x137/0x190
>  i40e_ndo_fdb_add+0x161/0x260 [i40e]
>  rtnl_fdb_add+0x567/0x950
>  rtnetlink_rcv_msg+0x5db/0x880
>  netlink_rcv_skb+0x254/0x380
>  netlink_unicast+0x454/0x610
>  netlink_sendmsg+0x747/0xb00
>  sock_sendmsg+0xe2/0x120
>  __sys_sendto+0x1ae/0x290
>  __x64_sys_sendto+0xdd/0x1b0
>  do_syscall_64+0xa0/0x370
>  entry_SYSCALL_64_after_hwframe+0x65/0xca
>
> Freed by task 21948:
>  __kasan_slab_free+0x137/0x190
>  kfree+0x8b/0x1b0
>  __i40e_del_filter+0x116/0x1e0 [i40e]
>  i40e_del_mac_filter+0x16c/0x300 [i40e]
>  i40e_addr_unsync+0x134/0x1b0 [i40e]
>  __hw_addr_sync_dev+0xff/0x2f0
>  i40e_set_rx_mode+0x61/0x1e0 [i40e]
>  dev_uc_del+0x77/0x90
>  rtnl_fdb_del+0x6a5/0x860
>  rtnetlink_rcv_msg+0x5db/0x880
>  netlink_rcv_skb+0x254/0x380
>  netlink_unicast+0x454/0x610
>  netlink_sendmsg+0x747/0xb00
>  sock_sendmsg+0xe2/0x120
>  __sys_sendto+0x1ae/0x290
>  __x64_sys_sendto+0xdd/0x1b0
>  do_syscall_64+0xa0/0x370
>  entry_SYSCALL_64_after_hwframe+0x65/0xca
>
> Fixes: 3116f59c12bd ("i40e: fix use-after-free in i40e_sync_filters_subta=
sk()")
> Fixes: 41c445ff0f48 ("i40e: main driver core")
> Signed-off-by: Ke Xiao <xiaoke@sangfor.com.cn>
> Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
> Cc: Di Zhu <zhudi2@huawei.com>
> Reviewed-by: Jan Sokolowski <jan.sokolowski@intel.com>
> Reviewed-by: Simon Horman <horms@kernel.org>
> ---
> v2:
> - Order local variable declarations in Reverse Christmas Tree (RCT)
>
> ---
>  drivers/net/ethernet/intel/i40e/i40e_main.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>

Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Co=
ntingent worker at Intel)