In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Handle pairing of E-switch via uplink un/load APIs
In case user switch a device from switchdev mode to legacy mode, mlx5 first unpair the E-switch and afterwards unload the uplink vport. From the other hand, in case user remove or reload a device, mlx5 first unload the uplink vport and afterwards unpair the E-switch.
The latter is causing a bug[1], hence, handle pairing of E-switch as part of uplink un/load APIs.
[1] In case VFLAG is used, every tc fdb flow is duplicated to the peer esw. However, the original esw keeps a pointer to this duplicated flow, not the peer esw. e.g.: if user create tc fdb flow over esw0, the flow is duplicated over esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated flow. During module unload while a peer tc fdb flow is still offloaded, in case the first device to be removed is the peer device (esw1 in the example above), the peer net-dev is destroyed, and so the mlx5epriv is memset to 0. Afterwards, the peer device is trying to unpair himself from the original device (esw0 in the example above). Unpair API invoke the original device to clear peer flow from its eswitch (esw0), but the peer flow, which is stored over the original eswitch (esw0), is trying to use the peer mlx5e_priv, which is memset to 0 and result in bellow kernel-oops.
[ 157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60 [ 157.964662 ] #PF: supervisor read access in kernel mode [ 157.965123 ] #PF: errorcode(0x0000) - not-present page [ 157.965582 ] PGD 0 P4D 0 [ 157.965866 ] Oops: 0000 [#1] SMP [ 157.967670 ] RIP: 0010:mlx5etcdelfdbflow+0x48/0x460 [mlx5core] [ 157.976164 ] Call Trace: [ 157.976437 ] <TASK> [ 157.976690 ] _mlx5etcdelfdbpeerflow+0xe6/0x100 [mlx5core] [ 157.977230 ] mlx5etccleanfdbpeerflows+0x67/0x90 [mlx5core] [ 157.977767 ] mlx5eswoffloadsunpair+0x2d/0x1e0 [mlx5core] [ 157.984653 ] mlx5eswoffloadsdevcomevent+0xbf/0x130 [mlx5core] [ 157.985212 ] mlx5devcomsendevent+0xa3/0xb0 [mlx5core] [ 157.985714 ] eswoffloadsdisable+0x5a/0x110 [mlx5core] [ 157.986209 ] mlx5eswitchdisablelocked+0x152/0x170 [mlx5core] [ 157.986757 ] mlx5eswitchdisable+0x51/0x80 [mlx5core] [ 157.987248 ] mlx5unload+0x2a/0xb0 [mlx5core] [ 157.987678 ] mlx5uninitone+0x5f/0xd0 [mlx5core] [ 157.988127 ] removeone+0x64/0xe0 [mlx5core] [ 157.988549 ] pcideviceremove+0x31/0xa0 [ 157.988933 ] devicereleasedriverinternal+0x18f/0x1f0 [ 157.989402 ] driverdetach+0x3f/0x80 [ 157.989754 ] busremovedriver+0x70/0xf0 [ 157.990129 ] pciunregisterdriver+0x34/0x90 [ 157.990537 ] mlx5cleanup+0xc/0x1c [mlx5core] [ 157.990972 ] _x64sysdeletemodule+0x15a/0x250 [ 157.991398 ] ? exittousermodeprepare+0xea/0x110 [ 157.991840 ] dosyscall64+0x3d/0x90 [ 157.992198 ] entrySYSCALL64after_hwframe+0x46/0xb0
[
{
"signature_type": "Function",
"digest": {
"function_hash": "264707982183326125676921198549353414796",
"length": 1867.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
"function": "mlx5e_tc_esw_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-0325dc49",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90909026891781910385380491060025850663",
"12705159357704717280423729479768441012",
"184768169339380310049729941728989103754",
"175363425582970225002163894580575683000",
"277262827556941709328632467574839045058",
"199938909180744091766928948964568852381",
"89309877345583446178732540532447496899",
"225755904809695124401918399803658596859"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-0a856060",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "144210806284506519942065251150409724416",
"length": 455.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_devcom_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-0c242035",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "299872630620327930701344237744733561706",
"length": 1327.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_enable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-11cebe8b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149986137784890570422656161539913098923",
"313783813260200994587500585685807282054",
"37230445718186439508725768200926955805",
"150714043289392387304235880934566881834",
"206507137226634206265108342819917420975",
"208156186121217017882311719323564075464",
"148871218755836735895883264598012524589"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-2de43e0c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90694980194109474586552312765174725342",
"303335160041840997277826829030570813452",
"214260506879861674466476155068229853707",
"1522444711675103148025961733048388757",
"102607876789571436435079855353278662427",
"30516009373996364607784803606498060915",
"316756464452841801536658762294372313285",
"56927430745169614608371824941678225216",
"268951101681366130620766530714758412971",
"307275858184026526611841359347895992835",
"48805217881466131428356753881677412203",
"322089913731184015760256775268550365683",
"133859028777737946012078268698627910076",
"317044868711761745720168370456661726113",
"74842514471663235817415976137028745478",
"32796978377561287605495300950735554836"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-3a3b2467",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90694980194109474586552312765174725342",
"303335160041840997277826829030570813452",
"214260506879861674466476155068229853707",
"1522444711675103148025961733048388757",
"102607876789571436435079855353278662427",
"30516009373996364607784803606498060915",
"316756464452841801536658762294372313285",
"56927430745169614608371824941678225216",
"268951101681366130620766530714758412971",
"307275858184026526611841359347895992835",
"48805217881466131428356753881677412203",
"322089913731184015760256775268550365683",
"133859028777737946012078268698627910076",
"317044868711761745720168370456661726113",
"74842514471663235817415976137028745478",
"32796978377561287605495300950735554836"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-3eaf9727",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "144210806284506519942065251150409724416",
"length": 455.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_devcom_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-41ea0e6c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319623329981903308860868241844449607669",
"length": 320.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_disable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-42612e41",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319623329981903308860868241844449607669",
"length": 320.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_disable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-430155f0",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "299872630620327930701344237744733561706",
"length": 1327.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_enable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-4c8180ed",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "18926563387908848334488207770552125980",
"length": 320.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_devcom_cleanup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-652962bb",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "319623329981903308860868241844449607669",
"length": 320.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_disable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-66e69079",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "93718319567728597230761141030803590277",
"length": 1641.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
"function": "mlx5e_tc_esw_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-6773f2d2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90909026891781910385380491060025850663",
"12705159357704717280423729479768441012",
"184768169339380310049729941728989103754",
"175363425582970225002163894580575683000",
"277262827556941709328632467574839045058",
"199938909180744091766928948964568852381",
"89309877345583446178732540532447496899",
"225755904809695124401918399803658596859"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-800176a6",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182764095840883980732412135321239850072",
"194820691340853891644474304965912035437",
"275459715263670617768065459523194648527",
"150714043289392387304235880934566881834",
"206507137226634206265108342819917420975",
"208156186121217017882311719323564075464",
"148871218755836735895883264598012524589"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-8dfeecb1",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149986137784890570422656161539913098923",
"313783813260200994587500585685807282054",
"37230445718186439508725768200926955805",
"150714043289392387304235880934566881834",
"206507137226634206265108342819917420975",
"208156186121217017882311719323564075464",
"148871218755836735895883264598012524589"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-95533271",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "144210806284506519942065251150409724416",
"length": 455.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_devcom_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-9ccae4f1",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90694980194109474586552312765174725342",
"303335160041840997277826829030570813452",
"214260506879861674466476155068229853707",
"1522444711675103148025961733048388757",
"102607876789571436435079855353278662427",
"30516009373996364607784803606498060915",
"316756464452841801536658762294372313285",
"56927430745169614608371824941678225216",
"268951101681366130620766530714758412971",
"307275858184026526611841359347895992835",
"48805217881466131428356753881677412203",
"322089913731184015760256775268550365683",
"133859028777737946012078268698627910076",
"317044868711761745720168370456661726113",
"74842514471663235817415976137028745478",
"32796978377561287605495300950735554836"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-a88e400b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "18926563387908848334488207770552125980",
"length": 320.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_devcom_cleanup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-cca66e84",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90909026891781910385380491060025850663",
"12705159357704717280423729479768441012",
"184768169339380310049729941728989103754",
"175363425582970225002163894580575683000",
"277262827556941709328632467574839045058",
"199938909180744091766928948964568852381",
"89309877345583446178732540532447496899",
"225755904809695124401918399803658596859"
]
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-cec1fbca",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "18926563387908848334488207770552125980",
"length": 320.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_devcom_cleanup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10cbfecc0f99f579fb170feee866c9efaab7ee47",
"id": "CVE-2023-53347-d8f68927",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "299872630620327930701344237744733561706",
"length": 1327.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c",
"function": "esw_offloads_enable"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
"id": "CVE-2023-53347-e93156b5",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "264707982183326125676921198549353414796",
"length": 1867.0
},
"target": {
"file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
"function": "mlx5e_tc_esw_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2be5bd42a5bba1a05daedc86cf0e248210009669",
"id": "CVE-2023-53347-f2c3aba7",
"deprecated": false,
"signature_version": "v1"
}
]