CVE-2023-52487

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix peer flow lists handling

The cited change refactored mlx5etcdelfdbpeerflow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent user holds a reference to a peer flow (for example, the neighbor update workqueue task is updating peer flow's parent encap entry concurrently), then the flow will not be removed from the peer list and, consecutively, DUP flag will remain set. Since mlx5etcdelfdbpeersflow() calls mlx5etcdelfdbpeerflow() for every possible peer index the algorithm will try to remove the flow from eswitch instances that it has never peered with causing either NULL pointer dereference when trying to remove the flow peer list head of peerindex that was never initialized or a warning if the list debug config is enabled[0].

Fix the issue by always removing the peer flow from the list even when not releasing the last reference to it.

[0]:

[ 3102.985806] ------------[ cut here ]------------ [ 3102.986223] listdel corruption, ffff888139110698->next is NULL [ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/listdebug.c:53 listdelentryvalidorreport+0x4f/0xc0 [ 3102.987561] Modules linked in: actct nfflowtable bonding acttunnelkey actmirred actskbedit vxlan clsmatchall nfnetlinkcttimeout actgact clsflower schingress mlx5vdpa vringh vhostiotlb vdpa openvswitch nsh xtMASQUERADE nfconntracknetlink nfnetlink iptablenat xtaddrtype xtconntrack nfnat brnetfilter rpcsecgsskrb5 authrpcg ss oidregistry overlay rpcrdma rdmaucm ibiser libiscsi scsitransportiscsi ibumad rdmacm ibipoib iwcm ibcm mlx5ib ibuverbs ibcore mlx5core [last unloaded: bonding] [ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 [ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 3102.992605] RIP: 0010:listdelentryvalidorreport+0x4f/0xc0 [ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] DEL flow 00000000be367878 on port 0 [ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 [ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 [ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3103.003787] Call Trace: [ 3103.004055] <TASK> [ 3103.004297] ? _warn+0x7d/0x130 [ 3103.004623] ? _listdelentryvalidorreport+0x4f/0xc0 [ 3103.005094] ? reportbug+0xf1/0x1c0 [ 3103.005439] ? consoleunlock+0x4a/0xd0 [ 3103.005806] ? handlebug+0x3f/0x70 [ 3103.006149] ? excinvalidop+0x13/0x60 [ 3103.006531] ? asmexcinvalidop+0x16/0x20 [ 3103.007430] ? _listdelentryvalidorreport+0x4f/0xc0 [ 3103.007910] mlx5etcdelfdbpeersflow+0xcf/0x240 [mlx5core] [ 3103.008463] mlx5etcdelflow+0x46/0x270 [mlx5core] [ 3103.008944] mlx5eflowput+0x26/0x50 [mlx5core] [ 3103.009401] mlx5edeleteflower+0x25f/0x380 [mlx5core] [ 3103.009901] tcsetupcbdestroy+0xab/0x180 [ 3103.010292] flhwdestroyfilter+0x99/0xc0 [clsflower] [ 3103.010779] _fldelete+0x2d4/0x2f0 [clsflower] [ 3103.0 ---truncated---