From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBF3421A0A for ; Tue, 2 Apr 2024 06:43:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712040222; cv=none; b=tIiCHing3HHpmfKpS8WRazsux08inrxxkTNcmBOTbU3h924KObLgWTs+ASDQf1mObjV3C0o+iTscnw6pFryinOeq2WeGjRFZFFNTPKJQiOZrFilCEPqsBKQsFKpMGzHzPHRRl2O/5xwmQbxQvmFEEVCjZEjCVJOC8aiS70+tWac= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712040222; c=relaxed/simple; bh=7k+h9KR1CUm5Afh94PaDU2eKdaaOE9MkixS7L+5KNsI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=e8W8G0fqHes0J/o2X/CuHk+QisdmE11F80zB9ZCxMsBI72mwziPM+/CcUvmrzuKav0nPZuArYCkV/MskHPAyvdDFlGqlL+9IrjUqjOw/OD1Cqxe9YbLc0K2+Mkg0zXF9Nx6IDFl6xWYtVilHItkVjqAXY/qwdaPCLr2hpFWi2uE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SHtWjxXO; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="SHtWjxXO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EAAFBC433C7; Tue, 2 Apr 2024 06:43:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1712040222; bh=7k+h9KR1CUm5Afh94PaDU2eKdaaOE9MkixS7L+5KNsI=; h=From:To:Cc:Subject:Date:Reply-to:From; b=SHtWjxXOE6cefKr8RTVQ4upZBFH1wvfegH+rQyvZkAWU7+6pEEndQhbK71Auc5f99 gCkiFOs9ogN/cxTHzsXzpUULSmArVWbIB+nstJ064RFwIhERZDKiXGrjz2ro+ipk74 r4/xpJ3iTjkkRKh3ohHiEa0Q+vsADvUSFpWC7+uI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-26669: net/sched: flower: Fix chain template offload Date: Tue, 2 Apr 2024 08:43:37 +0200 Message-ID: <2024040237-CVE-2024-26669-ca3c@gregkh> X-Mailer: git-send-email 2.44.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5849; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=7k+h9KR1CUm5Afh94PaDU2eKdaaOE9MkixS7L+5KNsI=; b=owGbwMvMwCRo6H6F97bub03G02pJDGncKyVniITFmayZalyT5XVkpV5KdekRmby/toYCfv9+P hJVZl7eEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABORFWBYMMMn84W5Q84Xr/bz J+q/X5nqyS68iWHBkfjmzan7glmFFmlwa8pkveT+y20BAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the 'reoffload' operation of the classifier being used. In turn, the classifier in its 'reoffload' operation prepares and emits a 'FLOW_CLS_DESTROY' command for each filter. However, the stack does not do the same for chain templates and the underlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2]. Fix by introducing a 'tmplt_reoffload' operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}' command based on whether a flow offload callback is being bound to a filter block or being unbound from one. As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chains. [1] unreferenced object 0xffff888107e28800 (size 2048): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[...... 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................ backtrace: [] __kmem_cache_alloc_node+0x1e8/0x320 [] __kmalloc+0x4e/0x90 [] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0 [] mlxsw_sp_flower_tmplt_create+0x145/0x180 [] mlxsw_sp_flow_block_cb+0x1ea/0x280 [] tc_setup_cb_call+0x183/0x340 [] fl_tmplt_create+0x3da/0x4c0 [] tc_ctl_chain+0xa15/0x1170 [] rtnetlink_rcv_msg+0x3cc/0xed0 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x540/0x820 [] netlink_sendmsg+0x8d8/0xda0 [] ____sys_sendmsg+0x30f/0xa80 [] ___sys_sendmsg+0x13a/0x1e0 [] __sys_sendmsg+0x11c/0x1f0 [] do_syscall_64+0x40/0xe0 unreferenced object 0xffff88816d2c0400 (size 1024): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8..... 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m.... backtrace: [] __kmem_cache_alloc_node+0x1e8/0x320 [] __kmalloc_node+0x51/0x90 [] kvmalloc_node+0xa6/0x1f0 [] bucket_table_alloc.isra.0+0x83/0x460 [] rhashtable_init+0x43b/0x7c0 [] mlxsw_sp_acl_ruleset_get+0x428/0x7a0 [] mlxsw_sp_flower_tmplt_create+0x145/0x180 [] mlxsw_sp_flow_block_cb+0x1ea/0x280 [] tc_setup_cb_call+0x183/0x340 [] fl_tmplt_create+0x3da/0x4c0 [] tc_ctl_chain+0xa15/0x1170 [] rtnetlink_rcv_msg+0x3cc/0xed0 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x540/0x820 [] netlink_sendmsg+0x8d8/0xda0 [] ____sys_sendmsg+0x30f/0xa80 [2] # tc qdisc add dev swp1 clsact # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32 # tc qdisc del dev swp1 clsact # devlink dev reload pci/0000:06:00.0 The Linux kernel CVE team has assigned CVE-2024-26669 to this issue. Affected and fixed versions =========================== Issue introduced in 5.1 with commit bbf73830cd48 and fixed in 6.6.15 with commit 9ed46144cff3 Issue introduced in 5.1 with commit bbf73830cd48 and fixed in 6.7.3 with commit c04709b2cc99 Issue introduced in 5.1 with commit bbf73830cd48 and fixed in 6.8 with commit 32f2a0afa95f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26669 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/net/sch_generic.h net/sched/cls_api.c net/sched/cls_flower.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97 https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01 https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8