cve/published/2024/CVE-2024-26669.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2024-26669: net/sched: flower: Fix chain template offload

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 net/sched: flower: Fix chain template offload

 When a qdisc is deleted from a net device the stack instructs the
 underlying driver to remove its flow offload callback from the
 associated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack
 then continues to replay the removal of the filters in the block for
 this driver by iterating over the chains in the block and invoking the
 'reoffload' operation of the classifier being used. In turn, the
 classifier in its 'reoffload' operation prepares and emits a
 'FLOW_CLS_DESTROY' command for each filter.

 However, the stack does not do the same for chain templates and the
 underlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when
 a qdisc is deleted. This results in a memory leak [1] which can be
 reproduced using [2].

 Fix by introducing a 'tmplt_reoffload' operation and have the stack
 invoke it with the appropriate arguments as part of the replay.
 Implement the operation in the sole classifier that supports chain
 templates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'
 command based on whether a flow offload callback is being bound to a
 filter block or being unbound from one.

 As far as I can tell, the issue happens since cited commit which
 reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()
 in __tcf_block_put(). The order cannot be reversed as the filter block
 is expected to be freed after flushing all the chains.

 [1]
 unreferenced object 0xffff888107e28800 (size 2048):
   comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s)
   hex dump (first 32 bytes):
     b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff  ..|......[......
     01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff  ................
   backtrace:
     [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320
     [<ffffffff81ab374e>] __kmalloc+0x4e/0x90
     [<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0
     [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180
     [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280
     [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340
     [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0
     [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170
     [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0
     [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440
     [<ffffffff83ac6270>] netlink_unicast+0x540/0x820
     [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0
     [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80
     [<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0
     [<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0
     [<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0
 unreferenced object 0xffff88816d2c0400 (size 1024):
   comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s)
   hex dump (first 32 bytes):
     40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00  @.......W.8.....
     10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff  ..,m......,m....
   backtrace:
     [<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320
     [<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90
     [<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0
     [<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460
     [<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0
     [<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0
     [<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180
     [<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280
     [<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340
     [<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0
     [<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170
     [<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0
     [<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440
     [<ffffffff83ac6270>] netlink_unicast+0x540/0x820
     [<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0
     [<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80

 [2]
  # tc qdisc add dev swp1 clsact
  # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32
  # tc qdisc del dev swp1 clsact
  # devlink dev reload pci/0000:06:00.0

 The Linux kernel CVE team has assigned CVE-2024-26669 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 5.1 with commit bbf73830cd48cff1599811d4f69c7cfd49c7b869 and fixed in 6.6.15 with commit 9ed46144cff3598a5cf79955630e795ff9af5b97
 	Issue introduced in 5.1 with commit bbf73830cd48cff1599811d4f69c7cfd49c7b869 and fixed in 6.7.3 with commit c04709b2cc99ae31c346f79f0211752d7b74df01
 	Issue introduced in 5.1 with commit bbf73830cd48cff1599811d4f69c7cfd49c7b869 and fixed in 6.8 with commit 32f2a0afa95fae0d1ceec2ff06e0e816939964b8

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2024-26669
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	include/net/sch_generic.h
 	net/sched/cls_api.c
 	net/sched/cls_flower.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97
 	https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01
 	https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2024-26669: net/sched: flower: Fix chain template offload

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	net/sched: flower: Fix chain template offload

	When a qdisc is deleted from a net device the stack instructs the
	underlying driver to remove its flow offload callback from the
	associated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack
	then continues to replay the removal of the filters in the block for
	this driver by iterating over the chains in the block and invoking the
	'reoffload' operation of the classifier being used. In turn, the
	classifier in its 'reoffload' operation prepares and emits a
	'FLOW_CLS_DESTROY' command for each filter.

	However, the stack does not do the same for chain templates and the
	underlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when
	a qdisc is deleted. This results in a memory leak [1] which can be
	reproduced using [2].

	Fix by introducing a 'tmplt_reoffload' operation and have the stack
	invoke it with the appropriate arguments as part of the replay.
	Implement the operation in the sole classifier that supports chain
	templates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'
	command based on whether a flow offload callback is being bound to a
	filter block or being unbound from one.

	As far as I can tell, the issue happens since cited commit which
	reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()
	in __tcf_block_put(). The order cannot be reversed as the filter block
	is expected to be freed after flushing all the chains.

	[1]
	unreferenced object 0xffff888107e28800 (size 2048):
	comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s)
	hex dump (first 32 bytes):
	b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..\|......[......
	01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................
	backtrace:
	[<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320
	[<ffffffff81ab374e>] __kmalloc+0x4e/0x90
	[<ffffffff832aec6d>] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0
	[<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180
	[<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280
	[<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340
	[<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0
	[<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170
	[<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0
	[<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440
	[<ffffffff83ac6270>] netlink_unicast+0x540/0x820
	[<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0
	[<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80
	[<ffffffff8379d29a>] ___sys_sendmsg+0x13a/0x1e0
	[<ffffffff8379d50c>] __sys_sendmsg+0x11c/0x1f0
	[<ffffffff843b9ce0>] do_syscall_64+0x40/0xe0
	unreferenced object 0xffff88816d2c0400 (size 1024):
	comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s)
	hex dump (first 32 bytes):
	40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8.....
	10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m....
	backtrace:
	[<ffffffff81c06a68>] __kmem_cache_alloc_node+0x1e8/0x320
	[<ffffffff81ab36c1>] __kmalloc_node+0x51/0x90
	[<ffffffff81a8ed96>] kvmalloc_node+0xa6/0x1f0
	[<ffffffff82827d03>] bucket_table_alloc.isra.0+0x83/0x460
	[<ffffffff82828d2b>] rhashtable_init+0x43b/0x7c0
	[<ffffffff832aed48>] mlxsw_sp_acl_ruleset_get+0x428/0x7a0
	[<ffffffff832bc195>] mlxsw_sp_flower_tmplt_create+0x145/0x180
	[<ffffffff832b2e1a>] mlxsw_sp_flow_block_cb+0x1ea/0x280
	[<ffffffff83a10613>] tc_setup_cb_call+0x183/0x340
	[<ffffffff83a9f85a>] fl_tmplt_create+0x3da/0x4c0
	[<ffffffff83a22435>] tc_ctl_chain+0xa15/0x1170
	[<ffffffff838a863c>] rtnetlink_rcv_msg+0x3cc/0xed0
	[<ffffffff83ac87f0>] netlink_rcv_skb+0x170/0x440
	[<ffffffff83ac6270>] netlink_unicast+0x540/0x820
	[<ffffffff83ac6e28>] netlink_sendmsg+0x8d8/0xda0
	[<ffffffff83793def>] ____sys_sendmsg+0x30f/0xa80

	[2]
	# tc qdisc add dev swp1 clsact
	# tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32
	# tc qdisc del dev swp1 clsact
	# devlink dev reload pci/0000:06:00.0

	The Linux kernel CVE team has assigned CVE-2024-26669 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 5.1 with commit bbf73830cd48cff1599811d4f69c7cfd49c7b869 and fixed in 6.6.15 with commit 9ed46144cff3598a5cf79955630e795ff9af5b97
	Issue introduced in 5.1 with commit bbf73830cd48cff1599811d4f69c7cfd49c7b869 and fixed in 6.7.3 with commit c04709b2cc99ae31c346f79f0211752d7b74df01
	Issue introduced in 5.1 with commit bbf73830cd48cff1599811d4f69c7cfd49c7b869 and fixed in 6.8 with commit 32f2a0afa95fae0d1ceec2ff06e0e816939964b8

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26669
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	include/net/sch_generic.h
	net/sched/cls_api.c
	net/sched/cls_flower.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/9ed46144cff3598a5cf79955630e795ff9af5b97
	https://git.kernel.org/stable/c/c04709b2cc99ae31c346f79f0211752d7b74df01
	https://git.kernel.org/stable/c/32f2a0afa95fae0d1ceec2ff06e0e816939964b8