mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-05 02:16:43 +07:00
ac493452e9
[ Upstream commit 9453d45ecb6c2199d72e73c993e9d98677a2801b ]
Function skb_ext_add() doesn't initialize created skb extension with any
value and leaves it up to the user. However, since extension of type
TC_SKB_EXT originally contained only single value tc_skb_ext->chain its
users used to just assign the chain value without setting whole extension
memory to zero first. This assumption changed when TC_SKB_EXT extension was
extended with additional fields but not all users were updated to
initialize the new fields which leads to use of uninitialized memory
afterwards. UBSAN log:
[ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28
[ 778.301495] load of value 107 is not a valid value for type '_Bool'
[ 778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7+ #2
[ 778.304933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[ 778.307901] Call Trace:
[ 778.308680] <IRQ>
[ 778.309358] dump_stack+0xbb/0x107
[ 778.310307] ubsan_epilogue+0x5/0x40
[ 778.311167] __ubsan_handle_load_invalid_value.cold+0x43/0x48
[ 778.312454] ? memset+0x20/0x40
[ 778.313230] ovs_flow_key_extract.cold+0xf/0x14 [openvswitch]
[ 778.314532] ovs_vport_receive+0x19e/0x2e0 [openvswitch]
[ 778.315749] ? ovs_vport_find_upcall_portid+0x330/0x330 [openvswitch]
[ 778.317188] ? create_prof_cpu_mask+0x20/0x20
[ 778.318220] ? arch_stack_walk+0x82/0xf0
[ 778.319153] ? secondary_startup_64_no_verify+0xb0/0xbb
[ 778.320399] ? stack_trace_save+0x91/0xc0
[ 778.321362] ? stack_trace_consume_entry+0x160/0x160
[ 778.322517] ? lock_release+0x52e/0x760
[ 778.323444] netdev_frame_hook+0x323/0x610 [openvswitch]
[ 778.324668] ? ovs_netdev_get_vport+0xe0/0xe0 [openvswitch]
[ 778.325950] __netif_receive_skb_core+0x771/0x2db0
[ 778.327067] ? lock_downgrade+0x6e0/0x6f0
[ 778.328021] ? lock_acquire+0x565/0x720
[ 778.328940] ? generic_xdp_tx+0x4f0/0x4f0
[ 778.329902] ? inet_gro_receive+0x2a7/0x10a0
[ 778.330914] ? lock_downgrade+0x6f0/0x6f0
[ 778.331867] ? udp4_gro_receive+0x4c4/0x13e0
[ 778.332876] ? lock_release+0x52e/0x760
[ 778.333808] ? dev_gro_receive+0xcc8/0x2380
[ 778.334810] ? lock_downgrade+0x6f0/0x6f0
[ 778.335769] __netif_receive_skb_list_core+0x295/0x820
[ 778.336955] ? process_backlog+0x780/0x780
[ 778.337941] ? mlx5e_rep_tc_netdevice_event_unregister+0x20/0x20 [mlx5_core]
[ 778.339613] ? seqcount_lockdep_reader_access.constprop.0+0xa7/0xc0
[ 778.341033] ? kvm_clock_get_cycles+0x14/0x20
[ 778.342072] netif_receive_skb_list_internal+0x5f5/0xcb0
[ 778.343288] ? __kasan_kmalloc+0x7a/0x90
[ 778.344234] ? mlx5e_handle_rx_cqe_mpwrq+0x9e0/0x9e0 [mlx5_core]
[ 778.345676] ? mlx5e_xmit_xdp_frame_mpwqe+0x14d0/0x14d0 [mlx5_core]
[ 778.347140] ? __netif_receive_skb_list_core+0x820/0x820
[ 778.348351] ? mlx5e_post_rx_mpwqes+0xa6/0x25d0 [mlx5_core]
[ 778.349688] ? napi_gro_flush+0x26c/0x3c0
[ 778.350641] napi_complete_done+0x188/0x6b0
[ 778.351627] mlx5e_napi_poll+0x373/0x1b80 [mlx5_core]
[ 778.352853] __napi_poll+0x9f/0x510
[ 778.353704] ? mlx5_flow_namespace_set_mode+0x260/0x260 [mlx5_core]
[ 778.355158] net_rx_action+0x34c/0xa40
[ 778.356060] ? napi_threaded_poll+0x3d0/0x3d0
[ 778.357083] ? sched_clock_cpu+0x18/0x190
[ 778.358041] ? __common_interrupt+0x8e/0x1a0
[ 778.359045] __do_softirq+0x1ce/0x984
[ 778.359938] __irq_exit_rcu+0x137/0x1d0
[ 778.360865] irq_exit_rcu+0xa/0x20
[ 778.361708] common_interrupt+0x80/0xa0
[ 778.362640] </IRQ>
[ 778.363212] asm_common_interrupt+0x1e/0x40
[ 778.364204] RIP: 0010:native_safe_halt+0xe/0x10
[ 778.365273] Code: 4f ff ff ff 4c 89 e7 e8 50 3f 40 fe e9 dc fe ff ff 48 89 df e8 43 3f 40 fe eb 90 cc e9 07 00 00 00 0f 00 2d 74 05 62 00 fb f4 <c3> 90 e9 07 00 00 00 0f 00 2d 64 05 62 00 f4 c3 cc cc 0f 1f 44 00
[ 778.369355] RSP: 0018:ffffffff84407e48 EFLAGS: 00000246
[ 778.370570] RAX: ffff88842de46a80 RBX: ffffffff84425840 RCX: ffffffff83418468
[ 778.372143] RDX: 000000000026f1da RSI: 0000000000000004 RDI: ffffffff8343af5e
[ 778.373722] RBP: fffffbfff0884b08 R08: 0000000000000000 R09: ffff88842de46bcb
[ 778.375292] R10: ffffed1085bc8d79 R11: 0000000000000001 R12: 0000000000000000
[ 778.376860] R13: ffffffff851124a0 R14: 0000000000000000 R15: dffffc0000000000
[ 778.378491] ? rcu_eqs_enter.constprop.0+0xb8/0xe0
[ 778.379606] ? default_idle_call+0x5e/0xe0
[ 778.380578] default_idle+0xa/0x10
[ 778.381406] default_idle_call+0x96/0xe0
[ 778.382350] do_idle+0x3d4/0x550
[ 778.383153] ? arch_cpu_idle_exit+0x40/0x40
[ 778.384143] cpu_startup_entry+0x19/0x20
[ 778.385078] start_kernel+0x3c7/0x3e5
[ 778.385978] secondary_startup_64_no_verify+0xb0/0xbb
Fix the issue by providing new function tc_skb_ext_alloc() that allocates
tc skb extension and initializes its memory to 0 before returning it to the
caller. Change all existing users to use new API instead of calling
skb_ext_add() directly.
Fixes:
|
||
---|---|---|
.. | ||
9p | ||
bluetooth | ||
caif | ||
iucv | ||
netfilter | ||
netns | ||
nfc | ||
phonet | ||
sctp | ||
tc_act | ||
6lowpan.h | ||
act_api.h | ||
addrconf.h | ||
af_ieee802154.h | ||
af_rxrpc.h | ||
af_unix.h | ||
af_vsock.h | ||
ah.h | ||
arp.h | ||
atmclip.h | ||
ax25.h | ||
ax88796.h | ||
bareudp.h | ||
bond_3ad.h | ||
bond_alb.h | ||
bond_options.h | ||
bonding.h | ||
bpf_sk_storage.h | ||
busy_poll.h | ||
calipso.h | ||
cfg80211-wext.h | ||
cfg80211.h | ||
cfg802154.h | ||
checksum.h | ||
cipso_ipv4.h | ||
cls_cgroup.h | ||
codel_impl.h | ||
codel_qdisc.h | ||
codel.h | ||
compat.h | ||
datalink.h | ||
dcbevent.h | ||
dcbnl.h | ||
devlink.h | ||
dn_dev.h | ||
dn_fib.h | ||
dn_neigh.h | ||
dn_nsp.h | ||
dn_route.h | ||
dn.h | ||
dsa.h | ||
dsfield.h | ||
dst_cache.h | ||
dst_metadata.h | ||
dst_ops.h | ||
dst.h | ||
erspan.h | ||
esp.h | ||
espintcp.h | ||
ethoc.h | ||
failover.h | ||
fib_notifier.h | ||
fib_rules.h | ||
firewire.h | ||
flow_dissector.h | ||
flow_offload.h | ||
flow.h | ||
fou.h | ||
fq_impl.h | ||
fq.h | ||
garp.h | ||
gen_stats.h | ||
genetlink.h | ||
geneve.h | ||
gre.h | ||
gro_cells.h | ||
gtp.h | ||
gue.h | ||
hwbm.h | ||
icmp.h | ||
ieee80211_radiotap.h | ||
ieee802154_netdev.h | ||
if_inet6.h | ||
ife.h | ||
ila.h | ||
inet6_connection_sock.h | ||
inet6_hashtables.h | ||
inet_common.h | ||
inet_connection_sock.h | ||
inet_ecn.h | ||
inet_frag.h | ||
inet_hashtables.h | ||
inet_sock.h | ||
inet_timewait_sock.h | ||
inetpeer.h | ||
ip6_checksum.h | ||
ip6_fib.h | ||
ip6_route.h | ||
ip6_tunnel.h | ||
ip_fib.h | ||
ip_tunnels.h | ||
ip_vs.h | ||
ip.h | ||
ipcomp.h | ||
ipconfig.h | ||
ipv6_frag.h | ||
ipv6_stubs.h | ||
ipv6.h | ||
ipx.h | ||
iw_handler.h | ||
kcm.h | ||
l3mdev.h | ||
lag.h | ||
lapb.h | ||
lib80211.h | ||
llc_c_ac.h | ||
llc_c_ev.h | ||
llc_c_st.h | ||
llc_conn.h | ||
llc_if.h | ||
llc_pdu.h | ||
llc_s_ac.h | ||
llc_s_ev.h | ||
llc_s_st.h | ||
llc_sap.h | ||
llc.h | ||
lwtunnel.h | ||
mac80211.h | ||
mac802154.h | ||
macsec.h | ||
mip6.h | ||
mld.h | ||
mpls_iptunnel.h | ||
mpls.h | ||
mptcp.h | ||
mrp.h | ||
ncsi.h | ||
ndisc.h | ||
neighbour.h | ||
net_failover.h | ||
net_namespace.h | ||
net_ratelimit.h | ||
netevent.h | ||
netlabel.h | ||
netlink.h | ||
netprio_cgroup.h | ||
netrom.h | ||
nexthop.h | ||
nl802154.h | ||
nsh.h | ||
p8022.h | ||
page_pool.h | ||
pie.h | ||
ping.h | ||
pkt_cls.h | ||
pkt_sched.h | ||
pptp.h | ||
protocol.h | ||
psample.h | ||
psnap.h | ||
raw.h | ||
rawv6.h | ||
red.h | ||
regulatory.h | ||
request_sock.h | ||
rose.h | ||
route.h | ||
rpl.h | ||
rsi_91x.h | ||
rtnetlink.h | ||
rtnh.h | ||
sch_generic.h | ||
scm.h | ||
secure_seq.h | ||
seg6_hmac.h | ||
seg6_local.h | ||
seg6.h | ||
slhc_vj.h | ||
smc.h | ||
snmp.h | ||
sock_reuseport.h | ||
sock.h | ||
Space.h | ||
stp.h | ||
strparser.h | ||
switchdev.h | ||
tcp_states.h | ||
tcp.h | ||
timewait_sock.h | ||
tipc.h | ||
tls_toe.h | ||
tls.h | ||
transp_v6.h | ||
tso.h | ||
tun_proto.h | ||
udp_tunnel.h | ||
udp.h | ||
udplite.h | ||
vsock_addr.h | ||
vxlan.h | ||
wext.h | ||
wimax.h | ||
x25.h | ||
x25device.h | ||
xdp_priv.h | ||
xdp_sock_drv.h | ||
xdp_sock.h | ||
xdp.h | ||
xfrm.h | ||
xsk_buff_pool.h |