* [PATCH 5.10.y 0/1] Try to backport patch to fix CVE-2021-47247 on 5.10
@ 2025-03-24 9:29 Xiangyu Chen
2025-03-24 9:29 ` [PATCH 5.10.y 1/1] net/mlx5e: Fix use-after-free of encap entry in neigh update handler Xiangyu Chen
0 siblings, 1 reply; 3+ messages in thread
From: Xiangyu Chen @ 2025-03-24 9:29 UTC (permalink / raw)
To: vladbu, saeedm, roid; +Cc: zhe.he, stable
From: Xiangyu Chen <xiangyu.chen@windriver.com>
Try to backport commit fb1a3132ee1a ("net/mlx5e: Fix use-after-free of encap entry in neigh update handler")
to linux 5.10.y branch to fix CVE-2021-47247.
This commit modified the orginal commit due to kernel 5.10 doesn't have the
commit 0d9f96471493 ("net/mlx5e: Extract tc tunnel encap/decap code to dedicated file")
which moved encap/decap from en_tc.c to tc_tun_encap.c, so backport and move the
additional functions to en_tc.c instead of tc_tun_encap.c
Vlad Buslov (1):
net/mlx5e: Fix use-after-free of encap entry in neigh update handler
.../mellanox/mlx5/core/en/rep/neigh.c | 15 ++++-----
.../ethernet/mellanox/mlx5/core/en/rep/tc.c | 6 +---
.../net/ethernet/mellanox/mlx5/core/en_tc.c | 33 +++++++++++++++++--
.../net/ethernet/mellanox/mlx5/core/en_tc.h | 3 ++
4 files changed, 40 insertions(+), 17 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 5.10.y 1/1] net/mlx5e: Fix use-after-free of encap entry in neigh update handler
2025-03-24 9:29 [PATCH 5.10.y 0/1] Try to backport patch to fix CVE-2021-47247 on 5.10 Xiangyu Chen
@ 2025-03-24 9:29 ` Xiangyu Chen
2025-03-25 11:33 ` Sasha Levin
0 siblings, 1 reply; 3+ messages in thread
From: Xiangyu Chen @ 2025-03-24 9:29 UTC (permalink / raw)
To: vladbu, saeedm, roid; +Cc: zhe.he, stable
From: Vlad Buslov <vladbu@nvidia.com>
[ Upstream commit fb1a3132ee1ac968316e45d21a48703a6db0b6c3 ]
Function mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock
removal from TC filter update path and properly handle concurrent encap
entry insertion/deletion which can lead to following use-after-free:
[23827.464923] ==================================================================
[23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]
[23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635
[23827.472251]
[23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5
[23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]
[23827.476731] Call Trace:
[23827.477260] dump_stack+0xbb/0x107
[23827.477906] print_address_description.constprop.0+0x18/0x140
[23827.478896] ? mlx5e_encap_take+0x72/0x140 [mlx5_core]
[23827.479879] ? mlx5e_encap_take+0x72/0x140 [mlx5_core]
[23827.480905] kasan_report.cold+0x7c/0xd8
[23827.481701] ? mlx5e_encap_take+0x72/0x140 [mlx5_core]
[23827.482744] kasan_check_range+0x145/0x1a0
[23827.493112] mlx5e_encap_take+0x72/0x140 [mlx5_core]
[23827.494054] ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]
[23827.495296] mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]
[23827.496338] ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]
[23827.497486] ? read_word_at_a_time+0xe/0x20
[23827.498250] ? strscpy+0xa0/0x2a0
[23827.498889] process_one_work+0x8ac/0x14e0
[23827.499638] ? lockdep_hardirqs_on_prepare+0x400/0x400
[23827.500537] ? pwq_dec_nr_in_flight+0x2c0/0x2c0
[23827.501359] ? rwlock_bug.part.0+0x90/0x90
[23827.502116] worker_thread+0x53b/0x1220
[23827.502831] ? process_one_work+0x14e0/0x14e0
[23827.503627] kthread+0x328/0x3f0
[23827.504254] ? _raw_spin_unlock_irq+0x24/0x40
[23827.505065] ? __kthread_bind_mask+0x90/0x90
[23827.505912] ret_from_fork+0x1f/0x30
[23827.506621]
[23827.506987] Allocated by task 28248:
[23827.507694] kasan_save_stack+0x1b/0x40
[23827.508476] __kasan_kmalloc+0x7c/0x90
[23827.509197] mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]
[23827.510194] mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]
[23827.511218] __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]
[23827.512234] mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]
[23827.513298] tc_setup_cb_add+0x1d5/0x420
[23827.514023] fl_hw_replace_filter+0x382/0x6a0 [cls_flower]
[23827.514975] fl_change+0x2ceb/0x4a51 [cls_flower]
[23827.515821] tc_new_tfilter+0x89a/0x2070
[23827.516548] rtnetlink_rcv_msg+0x644/0x8c0
[23827.517300] netlink_rcv_skb+0x11d/0x340
[23827.518021] netlink_unicast+0x42b/0x700
[23827.518742] netlink_sendmsg+0x743/0xc20
[23827.519467] sock_sendmsg+0xb2/0xe0
[23827.520131] ____sys_sendmsg+0x590/0x770
[23827.520851] ___sys_sendmsg+0xd8/0x160
[23827.521552] __sys_sendmsg+0xb7/0x140
[23827.522238] do_syscall_64+0x3a/0x70
[23827.522907] entry_SYSCALL_64_after_hwframe+0x44/0xae
[23827.523797]
[23827.524163] Freed by task 25948:
[23827.524780] kasan_save_stack+0x1b/0x40
[23827.525488] kasan_set_track+0x1c/0x30
[23827.526187] kasan_set_free_info+0x20/0x30
[23827.526968] __kasan_slab_free+0xed/0x130
[23827.527709] slab_free_freelist_hook+0xcf/0x1d0
[23827.528528] kmem_cache_free_bulk+0x33a/0x6e0
[23827.529317] kfree_rcu_work+0x55f/0xb70
[23827.530024] process_one_work+0x8ac/0x14e0
[23827.530770] worker_thread+0x53b/0x1220
[23827.531480] kthread+0x328/0x3f0
[23827.532114] ret_from_fork+0x1f/0x30
[23827.532785]
[23827.533147] Last potentially related work creation:
[23827.534007] kasan_save_stack+0x1b/0x40
[23827.534710] kasan_record_aux_stack+0xab/0xc0
[23827.535492] kvfree_call_rcu+0x31/0x7b0
[23827.536206] mlx5e_tc_del_fdb_flow+0x577/0xef0 [mlx5_core]
[23827.537305] mlx5e_flow_put+0x49/0x80 [mlx5_core]
[23827.538290] mlx5e_delete_flower+0x6d1/0xe60 [mlx5_core]
[23827.539300] tc_setup_cb_destroy+0x18e/0x2f0
[23827.540144] fl_hw_destroy_filter+0x1d2/0x310 [cls_flower]
[23827.541148] __fl_delete+0x4dc/0x660 [cls_flower]
[23827.541985] fl_delete+0x97/0x160 [cls_flower]
[23827.542782] tc_del_tfilter+0x7ab/0x13d0
[23827.543503] rtnetlink_rcv_msg+0x644/0x8c0
[23827.544257] netlink_rcv_skb+0x11d/0x340
[23827.544981] netlink_unicast+0x42b/0x700
[23827.545700] netlink_sendmsg+0x743/0xc20
[23827.546424] sock_sendmsg+0xb2/0xe0
[23827.547084] ____sys_sendmsg+0x590/0x770
[23827.547850] ___sys_sendmsg+0xd8/0x160
[23827.548606] __sys_sendmsg+0xb7/0x140
[23827.549303] do_syscall_64+0x3a/0x70
[23827.549969] entry_SYSCALL_64_after_hwframe+0x44/0xae
[23827.550853]
[23827.551217] The buggy address belongs to the object at ffff8881d1322200
[23827.551217] which belongs to the cache kmalloc-256 of size 256
[23827.553341] The buggy address is located 140 bytes inside of
[23827.553341] 256-byte region [ffff8881d1322200, ffff8881d1322300)
[23827.555747] The buggy address belongs to the page:
[23827.556847] page:00000000898762aa refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d1320
[23827.558651] head:00000000898762aa order:2 compound_mapcount:0 compound_pincount:0
[23827.559961] flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff)
[23827.561243] raw: 002ffff800010200 dead000000000100 dead000000000122 ffff888100042b40
[23827.562653] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
[23827.564112] page dumped because: kasan: bad access detected
[23827.565439]
[23827.565932] Memory state around the buggy address:
[23827.566917] ffff8881d1322180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[23827.568485] ffff8881d1322200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[23827.569818] >ffff8881d1322280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[23827.571143] ^
[23827.571879] ffff8881d1322300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[23827.573283] ffff8881d1322380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[23827.574654] ==================================================================
Most of the necessary logic is already correctly implemented by
mlx5e_get_next_valid_encap() helper that is used in neigh stats update
handler. Make the handler generic by renaming it to
mlx5e_get_next_matching_encap() and use callback to test whether flow is
matching instead of hardcoded check for 'valid' flag value. Implement
mlx5e_get_next_valid_encap() by calling mlx5e_get_next_matching_encap()
with callback that tests encap MLX5_ENCAP_ENTRY_VALID flag. Implement new
mlx5e_get_next_init_encap() helper by calling
mlx5e_get_next_matching_encap() with callback that tests encap completion
result to be non-error and use it in mlx5e_rep_neigh_update() to safely
iterate over nhe->encap_list.
Remove encap completion logic from mlx5e_rep_update_flows() since the encap
entries passed to this function are already guaranteed to be properly
initialized by similar code in mlx5e_get_next_init_encap().
Fixes: 2a1f1768fa17 ("net/mlx5e: Refactor neigh update for concurrent execution")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
[ since kernel 5.10 doesn't have commit 0d9f96471493
("net/mlx5e: Extract tc tunnel encap/decap code to dedicated file")
which moved encap/decap from en_tc.c to tc_tun_encap.c, so backport and
move the additional functions to en_tc.c instead of tc_tun_encap.c ]
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
---
Build test passed.
---
.../mellanox/mlx5/core/en/rep/neigh.c | 15 ++++-----
.../ethernet/mellanox/mlx5/core/en/rep/tc.c | 6 +---
.../net/ethernet/mellanox/mlx5/core/en_tc.c | 33 +++++++++++++++++--
.../net/ethernet/mellanox/mlx5/core/en_tc.h | 3 ++
4 files changed, 40 insertions(+), 17 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c
index 58e27038c947..bbc182e9e535 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c
@@ -129,9 +129,8 @@ static void mlx5e_rep_neigh_update(struct work_struct *work)
work);
struct mlx5e_neigh_hash_entry *nhe = update_work->nhe;
struct neighbour *n = update_work->n;
- struct mlx5e_encap_entry *e;
+ struct mlx5e_encap_entry *e = NULL;
unsigned char ha[ETH_ALEN];
- struct mlx5e_priv *priv;
bool neigh_connected;
u8 nud_state, dead;
@@ -152,14 +151,12 @@ static void mlx5e_rep_neigh_update(struct work_struct *work)
trace_mlx5e_rep_neigh_update(nhe, ha, neigh_connected);
- list_for_each_entry(e, &nhe->encap_list, encap_list) {
- if (!mlx5e_encap_take(e))
- continue;
+ /* mlx5e_get_next_init_encap() releases previous encap before returning
+ * the next one.
+ */
+ while ((e = mlx5e_get_next_init_encap(nhe, e)) != NULL)
+ mlx5e_rep_update_flows(netdev_priv(e->out_dev), e, neigh_connected, ha);
- priv = netdev_priv(e->out_dev);
- mlx5e_rep_update_flows(priv, e, neigh_connected, ha);
- mlx5e_encap_put(priv, e);
- }
rtnl_unlock();
mlx5e_release_neigh_update_work(update_work);
}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
index 2fdea05eec1d..552c07e52682 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
@@ -91,13 +91,9 @@ void mlx5e_rep_update_flows(struct mlx5e_priv *priv,
ASSERT_RTNL();
- /* wait for encap to be fully initialized */
- wait_for_completion(&e->res_ready);
-
mutex_lock(&esw->offloads.encap_tbl_lock);
encap_connected = !!(e->flags & MLX5_ENCAP_ENTRY_VALID);
- if (e->compl_result < 0 || (encap_connected == neigh_connected &&
- ether_addr_equal(e->h_dest, ha)))
+ if (encap_connected == neigh_connected && ether_addr_equal(e->h_dest, ha))
goto unlock;
mlx5e_take_all_encap_flows(e, &flow_list);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index c6a81a51530d..6b4e028de9bf 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1653,9 +1653,12 @@ void mlx5e_put_encap_flow_list(struct mlx5e_priv *priv, struct list_head *flow_l
mlx5e_flow_put(priv, flow);
}
+typedef bool (match_cb)(struct mlx5e_encap_entry *);
+
static struct mlx5e_encap_entry *
-mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
- struct mlx5e_encap_entry *e)
+mlx5e_get_next_matching_encap(struct mlx5e_neigh_hash_entry *nhe,
+ struct mlx5e_encap_entry *e,
+ match_cb match)
{
struct mlx5e_encap_entry *next = NULL;
@@ -1690,7 +1693,7 @@ mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
/* wait for encap to be fully initialized */
wait_for_completion(&next->res_ready);
/* continue searching if encap entry is not in valid state after completion */
- if (!(next->flags & MLX5_ENCAP_ENTRY_VALID)) {
+ if (!match(next)) {
e = next;
goto retry;
}
@@ -1698,6 +1701,30 @@ mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
return next;
}
+static bool mlx5e_encap_valid(struct mlx5e_encap_entry *e)
+{
+ return e->flags & MLX5_ENCAP_ENTRY_VALID;
+}
+
+static struct mlx5e_encap_entry *
+mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
+ struct mlx5e_encap_entry *e)
+{
+ return mlx5e_get_next_matching_encap(nhe, e, mlx5e_encap_valid);
+}
+
+static bool mlx5e_encap_initialized(struct mlx5e_encap_entry *e)
+{
+ return e->compl_result >= 0;
+}
+
+struct mlx5e_encap_entry *
+mlx5e_get_next_init_encap(struct mlx5e_neigh_hash_entry *nhe,
+ struct mlx5e_encap_entry *e)
+{
+ return mlx5e_get_next_matching_encap(nhe, e, mlx5e_encap_initialized);
+}
+
void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
{
struct mlx5e_neigh *m_neigh = &nhe->m_neigh;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h
index 4a2ce241522e..e7e5f0c080fb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h
@@ -161,6 +161,9 @@ void mlx5e_take_all_encap_flows(struct mlx5e_encap_entry *e, struct list_head *f
void mlx5e_put_encap_flow_list(struct mlx5e_priv *priv, struct list_head *flow_list);
struct mlx5e_neigh_hash_entry;
+struct mlx5e_encap_entry *
+mlx5e_get_next_init_encap(struct mlx5e_neigh_hash_entry *nhe,
+ struct mlx5e_encap_entry *e);
void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe);
void mlx5e_tc_reoffload_flows_work(struct work_struct *work);
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 5.10.y 1/1] net/mlx5e: Fix use-after-free of encap entry in neigh update handler
2025-03-24 9:29 ` [PATCH 5.10.y 1/1] net/mlx5e: Fix use-after-free of encap entry in neigh update handler Xiangyu Chen
@ 2025-03-25 11:33 ` Sasha Levin
0 siblings, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2025-03-25 11:33 UTC (permalink / raw)
To: stable; +Cc: Xiangyu Chen, Sasha Levin
[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected.
No action required from the submitter.
The upstream commit SHA1 provided is correct: fb1a3132ee1ac968316e45d21a48703a6db0b6c3
WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen<xiangyu.chen@eng.windriver.com>
Commit author: Vlad Buslov<vladbu@nvidia.com>
Status in newer kernel trees:
6.13.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Present (exact SHA1)
6.1.y | Present (exact SHA1)
5.15.y | Present (exact SHA1)
Note: The patch differs from the upstream commit:
---
1: fb1a3132ee1ac ! 1: 3bc3763a234af net/mlx5e: Fix use-after-free of encap entry in neigh update handler
@@ Metadata
## Commit message ##
net/mlx5e: Fix use-after-free of encap entry in neigh update handler
+ [ Upstream commit fb1a3132ee1ac968316e45d21a48703a6db0b6c3 ]
+
Function mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock
removal from TC filter update path and properly handle concurrent encap
entry insertion/deletion which can lead to following use-after-free:
@@ Commit message
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+ [ since kernel 5.10 doesn't have commit 0d9f96471493
+ ("net/mlx5e: Extract tc tunnel encap/decap code to dedicated file")
+ which moved encap/decap from en_tc.c to tc_tun_encap.c, so backport and
+ move the additional functions to en_tc.c instead of tc_tun_encap.c ]
+ Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
+ Signed-off-by: He Zhe <zhe.he@windriver.com>
## drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c ##
@@ drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c: static void mlx5e_rep_neigh_update(struct work_struct *work)
work);
struct mlx5e_neigh_hash_entry *nhe = update_work->nhe;
struct neighbour *n = update_work->n;
-+ struct mlx5e_encap_entry *e = NULL;
- bool neigh_connected, same_dev;
- struct mlx5e_encap_entry *e;
++ struct mlx5e_encap_entry *e = NULL;
unsigned char ha[ETH_ALEN];
- struct mlx5e_priv *priv;
+ bool neigh_connected;
u8 nud_state, dead;
- rtnl_lock();
@@ drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c: static void mlx5e_rep_neigh_update(struct work_struct *work)
- if (!same_dev)
- goto out;
+
+ trace_mlx5e_rep_neigh_update(nhe, ha, neigh_connected);
- list_for_each_entry(e, &nhe->encap_list, encap_list) {
- if (!mlx5e_encap_take(e))
@@ drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c: static void mlx5e_rep_ne
- mlx5e_rep_update_flows(priv, e, neigh_connected, ha);
- mlx5e_encap_put(priv, e);
- }
- out:
rtnl_unlock();
mlx5e_release_neigh_update_work(update_work);
+ }
## drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c ##
@@ drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c: void mlx5e_rep_update_flows(struct mlx5e_priv *priv,
@@ drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c: void mlx5e_rep_update_flows
mlx5e_take_all_encap_flows(e, &flow_list);
- ## drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c ##
-@@ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c: static void mlx5e_take_all_route_decap_flows(struct mlx5e_route_entry *r,
- mlx5e_take_tmp_flow(flow, flow_list, 0);
+ ## drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ##
+@@ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c: void mlx5e_put_encap_flow_list(struct mlx5e_priv *priv, struct list_head *flow_l
+ mlx5e_flow_put(priv, flow);
}
+typedef bool (match_cb)(struct mlx5e_encap_entry *);
@@ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c: static void mlx5e_tak
-mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
- struct mlx5e_encap_entry *e)
+mlx5e_get_next_matching_encap(struct mlx5e_neigh_hash_entry *nhe,
-+ struct mlx5e_encap_entry *e,
-+ match_cb match)
++ struct mlx5e_encap_entry *e,
++ match_cb match)
{
struct mlx5e_encap_entry *next = NULL;
-@@ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c: mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
+@@ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c: mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
/* wait for encap to be fully initialized */
wait_for_completion(&next->res_ready);
/* continue searching if encap entry is not in valid state after completion */
@@ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c: mlx5e_get_next_valid_
e = next;
goto retry;
}
-@@ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c: mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
+@@ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c: mlx5e_get_next_valid_encap(struct mlx5e_neigh_hash_entry *nhe,
return next;
}
@@ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c: mlx5e_get_next_valid_
## drivers/net/ethernet/mellanox/mlx5/core/en_tc.h ##
@@ drivers/net/ethernet/mellanox/mlx5/core/en_tc.h: void mlx5e_take_all_encap_flows(struct mlx5e_encap_entry *e, struct list_head *f
- void mlx5e_put_flow_list(struct mlx5e_priv *priv, struct list_head *flow_list);
+ void mlx5e_put_encap_flow_list(struct mlx5e_priv *priv, struct list_head *flow_list);
struct mlx5e_neigh_hash_entry;
+struct mlx5e_encap_entry *
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y | Success | Success |
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-03-25 11:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-24 9:29 [PATCH 5.10.y 0/1] Try to backport patch to fix CVE-2021-47247 on 5.10 Xiangyu Chen
2025-03-24 9:29 ` [PATCH 5.10.y 1/1] net/mlx5e: Fix use-after-free of encap entry in neigh update handler Xiangyu Chen
2025-03-25 11:33 ` Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox