Commit 7989adb9 authored by Aleksandr Loktionov's avatar Aleksandr Loktionov Committed by Lin Yujun
Browse files

i40e: Fix macvlan leak by synchronizing access to mac_filter_hash 

stable inclusion
from stable-v6.6.57
commit 703c4d820b31bcadf465288d5746c53445f02a55
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJN
CVE: CVE-2024-50041

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=703c4d820b31bcadf465288d5746c53445f02a55



--------------------------------

[ Upstream commit dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb ]

This patch addresses a macvlan leak issue in the i40e driver caused by
concurrent access to vsi->mac_filter_hash. The leak occurs when multiple
threads attempt to modify the mac_filter_hash simultaneously, leading to
inconsistent state and potential memory leaks.

To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing
vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock),
ensuring atomic operations and preventing concurrent access.

Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in
i40e_add_mac_filter() to help catch similar issues in the future.

Reproduction steps:
1. Spawn VFs and configure port vlan on them.
2. Trigger concurrent macvlan operations (e.g., adding and deleting
	portvlan and/or mac filters).
3. Observe the potential memory leak and inconsistent state in the
	mac_filter_hash.

This synchronization ensures the integrity of the mac_filter_hash and prevents
the described leak.

Fixes: fed0d9f1 ("i40e: Fix VF's MAC Address change on VM")
Reviewed-by: default avatarArkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Signed-off-by: default avatarAleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Tested-by: default avatarRafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLin Yujun <linyujun809@huawei.com>
parent 4cd9ac5b

drivers/net/ethernet/intel/i40e/i40e_main.c

+1 −0
Original line number Diff line number Diff line
@@ -1744,6 +1744,7 @@ struct i40e_mac_filter *i40e_add_mac_filter(struct i40e_vsi *vsi, 
	struct hlist_node *h;

	int bkt;



	lockdep_assert_held(&vsi->mac_filter_hash_lock);

	if (vsi->info.pvid)

		return i40e_add_filter(vsi, macaddr,

				       le16_to_cpu(vsi->info.pvid));

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

+2 −0
Original line number Diff line number Diff line
@@ -2219,8 +2219,10 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) 
		vfres->vsi_res[0].qset_handle

					  = le16_to_cpu(vsi->info.qs_handle[0]);

		if (!(vf->driver_caps & VIRTCHNL_VF_OFFLOAD_USO) && !vf->pf_set_mac) {

			spin_lock_bh(&vsi->mac_filter_hash_lock);

			i40e_del_mac_filter(vsi, vf->default_lan_addr.addr);

			eth_zero_addr(vf->default_lan_addr.addr);

			spin_unlock_bh(&vsi->mac_filter_hash_lock);

		}

		ether_addr_copy(vfres->vsi_res[0].default_mac_addr,

				vf->default_lan_addr.addr);