Re: [PATCH net 3/3] net/mlx5: DR, Fix out-of-bounds write when sync to HW fails

[sashiko-bot@kernel.org]

> From: Yevgeny Kliteynik <kliteyn@nvidia.com>
> 
> mlx5dr_icm_free_chunk() moves a freed chunk to the "hot" chunks array by
> writing it to hot_chunks_arr and, once the accumulated hot memory
> crosses a threshold, triggers a sync to HW that flushes the array.  The
> array is large enough to hold the chunks of a single accumulation cycle,
> and relies on the sync path to flush it.
> 
> However, if sync to HW fails, hot chunks array is not cleared, and every
> subsequent mlx5dr_icm_free_chunk will write past the end of
> hot_chunks_arr, resulting in an out-of-bounds write and kernel heap
> corruption.
> 
> A failed sync to HW also means it is no longer safe to recycle ICM: a
> chunk's memory may only be returned to the buddy allocator (and thus be
> reused) after a sync has confirmed that HW no longer references it.
> 
> Fix both problems by putting the pool into an error state when a sync to
> HW fails - mlx5dr_icm_free_chunk() stops queuing freed chunks, so it
> never writes past hot_chunks_arr. The chunk's ICM memory is not returned
> to the buddy allocator (HW may still reference it); the segment is left
> reserved and is reclaimed when the pool is destroyed.
> 
> Fixes: 4519fc45beeb ("net/mlx5: DR, Keep track of hot ICM chunks in an array instead of list")
> Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
> Reviewed-by: Alex Vesker <valex@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021074949.3471704-1-tariqt@nvidia.com?part=3