From patchwork Sat Dec 2 09:59:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhipeng Lu X-Patchwork-Id: 172793 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp1678061vqy; Sat, 2 Dec 2023 02:02:03 -0800 (PST) X-Google-Smtp-Source: AGHT+IHtXrZcDectxWc02GJcISnj99EXGuo7xEaxwWd4tNl8ikpOUiRwV9BU1S7DYUXfoo1xziKk X-Received: by 2002:a05:6808:1a14:b0:3ae:1298:257a with SMTP id bk20-20020a0568081a1400b003ae1298257amr1376891oib.1.1701511322759; Sat, 02 Dec 2023 02:02:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701511322; cv=none; d=google.com; s=arc-20160816; b=dvZUUZ/VjJATNIDsKevT/xBrKlA+d8zf5zH+joPgMC2j7t1Qa5gbuaOpKIqtnAJLSZ Mcnr9V1lGjoIm23I5YMcnRq9+6kLjtBtMfxTWQ+Ixt71oTPeNP+Rn8qUSBkiqxe5M0yE +ug1zzZ0fgtTHTRK5y8UzfW5aoEVq1nUULVjaA2AgAiErnr57iiz6ptnz4kfW4iFHcaQ LBT95Mo10S1dEYg7pKbkKEj3ApI8U9K4J5P9SpV2mm7vRRkIcHqAUN1Nm4liVty1waDc tJVGrrB8ag4T1vdgioWMDG1lDy+51vTwq/Bemx1BQZnMsoux2i6pVplqI7l2k07kiM84 WesQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=YH5qFuZY8E6d9lxF/SMs5Zb0ZsA+epb9AGJMm2sWosI=; fh=3mbRBEdLW47GJe8yvg0QfixB0kP67LbsMv3+XUWMuso=; b=VZHJIlVwxaYqXwa39i4QBOyxQLzzgiwECpdtqDaGXpHPXgk7Fq4nShIkknQ7tJEIj/ aCoh4WLB5RQbUcl1tEouMBFpekzuWLzoih7Mb16/yDaBmxAkYhHq5V6n9DnRybxmy3F7 4qjohg06yTnoq7NbA8rvrhjGCuwT+fjaPBNTTl48oTP29AoxoUo7ugSMR6SEfnMcP4th THhjVBMYtGccguN2HecdKtR76VANDBPgexYG8HXD4L9FCAfzTu1Brh+r8HGuLfIl1G2u qQXQ2HSedSEGkTwRCcizc/zc/FfuatY9Q19XXb7KEzWC7dzWebovo/5sr1XLT2Rv/B4u ebyw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from fry.vger.email (fry.vger.email. [2620:137:e000::3:8]) by mx.google.com with ESMTPS id b2-20020a056a000cc200b006cbb7b7bed0si4827727pfv.201.2023.12.02.02.01.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 02 Dec 2023 02:02:02 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) client-ip=2620:137:e000::3:8; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by fry.vger.email (Postfix) with ESMTP id 4D14C8106F75; Sat, 2 Dec 2023 02:01:48 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at fry.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232548AbjLBKBe (ORCPT + 99 others); Sat, 2 Dec 2023 05:01:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232546AbjLBKBc (ORCPT ); Sat, 2 Dec 2023 05:01:32 -0500 Received: from zg8tmtyylji0my4xnjqumte4.icoremail.net (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 3D349CC; Sat, 2 Dec 2023 02:01:36 -0800 (PST) Received: from luzhipeng.223.5.5.5 (unknown [60.177.97.75]) by mail-app2 (Coremail) with SMTP id by_KCgCnrEz3_2plN6c7AA--.29237S2; Sat, 02 Dec 2023 17:59:19 +0800 (CST) From: Zhipeng Lu To: alexious@zju.edu.cn Cc: Sunil Goutham , Linu Cherian , Geetha sowjanya , Jerin Jacob , hariprasad , Subbaraya Sundeep , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , George Cherian , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] octeontx2-af: fix a use-after-free in rvu_npa_register_reporters Date: Sat, 2 Dec 2023 17:59:02 +0800 Message-Id: <20231202095902.3264863-1-alexious@zju.edu.cn> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-CM-TRANSID: by_KCgCnrEz3_2plN6c7AA--.29237S2 X-Coremail-Antispam: 1UD129KBjvJXoW7KFyxWFyftFy3Cr1xXFW7twb_yoW8tr18pF WrAry5Gr97t34jqF9rXa1Utay2k3Wktr4UWr1xKwnIg3WrJrsayrsaqF9YgFsxArWkGFWj qr4Yq3yUZrZrJr7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvC14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gc CE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxcIEc7CjxVA2 Y2ka0xkIwI1lc2xSY4AK67AK6r4fMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r 1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CE b7AF67AKxVWUtVW8ZwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0x vE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAI cVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2Kf nxnUUI43ZEXa7VUjMmh5UUUUU== X-CM-SenderInfo: qrsrjiarszq6lmxovvfxof0/ X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Sat, 02 Dec 2023 02:01:48 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784163936938301521 X-GMAIL-MSGID: 1784163936938301521 The rvu_dl will be freed in rvu_npa_health_reporters_destroy(rvu_dl) after the create_workqueue fails, and after that free, the rvu_dl will be translate back through rvu_npa_health_reporters_create, rvu_health_reporters_create, and rvu_register_dl. Finally it goes to the err_dl_health label, being freed again in rvu_health_reporters_destroy(rvu) by rvu_npa_health_reporters_destroy. In the second calls of rvu_npa_health_reporters_destroy, however, it uses rvu_dl->rvu_npa_health_reporter, which is already freed at the end of rvu_npa_health_reporters_destroy in the first call. So this patch prevents the first destroy by instantly returning -ENONMEN when create_workqueue fails. In addition, since the failure of create_workqueue is the only entrence of label err, it has been integrated into the error-handling path of create_workqueue. Fixes: f1168d1e207c ("octeontx2-af: Add devlink health reporters for NPA") Signed-off-by: Zhipeng Lu Acked-by: Paolo Abeni Acked-by: --- drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c index 41df5ac23f92..058f75dc4c8a 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c @@ -1285,7 +1285,7 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) rvu_dl->devlink_wq = create_workqueue("rvu_devlink_wq"); if (!rvu_dl->devlink_wq) - goto err; + return -ENOMEM; INIT_WORK(&rvu_reporters->intr_work, rvu_npa_intr_work); INIT_WORK(&rvu_reporters->err_work, rvu_npa_err_work); @@ -1293,9 +1293,6 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl) INIT_WORK(&rvu_reporters->ras_work, rvu_npa_ras_work); return 0; -err: - rvu_npa_health_reporters_destroy(rvu_dl); - return -ENOMEM; } static int rvu_npa_health_reporters_create(struct rvu_devlink *rvu_dl)