[5.10,017/167] ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops

From: Taehee Yoo <ap420073@gmail.com>

From: Taehee Yoo <ap420073@gmail.com>

[ Upstream commit 2de7e4f67599affc97132bd07e30e3bd59d0b777 ]

There are two pointers in struct xfrm_state_offload, *dev, *real_dev.
These are used in callback functions of struct xfrmdev_ops.
The *dev points whether bonding interface or real interface.
If bonding ipsec offload is used, it points bonding interface If not,
it points real interface.
And real_dev always points real interface.
So, ixgbevf should always use real_dev instead of dev.
Of course, real_dev always not be null.

Test commands:
    ip link add bond0 type bond
    #eth0 is ixgbevf interface
    ip link set eth0 master bond0
    ip link set bond0 up
    ip x s add proto esp dst 14.1.1.1 src 15.1.1.1 spi 0x07 mode \
transport reqid 0x07 replay-window 32 aead 'rfc4106(gcm(aes))' \
0x44434241343332312423222114131211f4f3f2f1 128 sel src 14.0.0.52/24 \
dst 14.0.0.70/24 proto tcp offload dev bond0 dir in

Splat looks like:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 6 PID: 688 Comm: ip Not tainted 5.13.0-rc3+ #1168
RIP: 0010:ixgbevf_ipsec_find_empty_idx+0x28/0x1b0 [ixgbevf]
Code: 00 00 0f 1f 44 00 00 55 53 48 89 fb 48 83 ec 08 40 84 f6 0f 84 9c
00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02
84 c0 74 08 3c 01 0f 8e 4c 01 00 00 66 81 3b 00 04 0f
RSP: 0018:ffff8880089af390 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff8880089af4f8 R08: 0000000000000003 R09: fffffbfff4287e11
R10: 0000000000000001 R11: ffff888005de8908 R12: 0000000000000000
R13: ffff88810936a000 R14: ffff88810936a000 R15: ffff888004d78040
FS:  00007fdf9883a680(0000) GS:ffff88811a400000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bc14adbf40 CR3: 000000000b87c005 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ixgbevf_ipsec_add_sa+0x1bf/0x9c0 [ixgbevf]
 ? rcu_read_lock_sched_held+0x91/0xc0
 ? ixgbevf_ipsec_parse_proto_keys.isra.9+0x280/0x280 [ixgbevf]
 ? lock_acquire+0x191/0x720
 ? bond_ipsec_add_sa+0x48/0x350 [bonding]
 ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0
 ? rcu_read_lock_held+0x91/0xa0
 ? rcu_read_lock_sched_held+0xc0/0xc0
 bond_ipsec_add_sa+0x193/0x350 [bonding]
 xfrm_dev_state_add+0x2a9/0x770
 ? memcpy+0x38/0x60
 xfrm_add_sa+0x2278/0x3b10 [xfrm_user]
 ? xfrm_get_policy+0xaa0/0xaa0 [xfrm_user]
 ? register_lock_class+0x1750/0x1750
 xfrm_user_rcv_msg+0x331/0x660 [xfrm_user]
 ? rcu_read_lock_sched_held+0x91/0xc0
 ? xfrm_user_state_lookup.constprop.39+0x320/0x320 [xfrm_user]
 ? find_held_lock+0x3a/0x1c0
 ? mutex_lock_io_nested+0x1210/0x1210
 ? sched_clock_cpu+0x18/0x170
 netlink_rcv_skb+0x121/0x350
[ ... ]

Fixes: 272c2330adc9 ("xfrm: bail early on slave pass over skb")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbevf/ipsec.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

Message ID	20210726153839.948495470@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Taehee Yoo <ap420073@gmail.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 017/167] ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops Date: Mon, 26 Jul 2021 17:37:30 +0200 Message-Id: <20210726153839.948495470@linuxfoundation.org> In-Reply-To: <20210726153839.371771838@linuxfoundation.org> References: <20210726153839.371771838@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,003/167] igc: change default return of igc_read_phy_reg() [5.10,006/167] igb: Fix an error handling path in igb_probe() [5.10,008/167] e1000e: Fix an error handling path in e1000_probe() [5.10,011/167] igb: Fix position of assignment to *ring [5.10,013/167] net: add kcov handle to skb extensions [5.10,014/167] net: Introduce preferred busy-polling [5.10,017/167] ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmd... [5.10,018/167] bonding: fix suspicious RCU usage in bond_ipsec_del_sa() [5.10,020/167] bonding: Add struct bond_ipesc to manage SA [5.10,022/167] bonding: fix incorrect return value of bond_ipsec_offload_ok() [5.10,024/167] stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() [5.10,027/167] pwm: sprd: Ensure configuring period and duty_cycle isnt wrongly skipped [5.10,028/167] cxgb4: fix IRQ free race during driver unload [5.10,032/167] KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM [5.10,034/167] perf map: Fix dso->nsinfo refcounting [5.10,035/167] perf probe: Fix dso->nsinfo refcounting [5.10,037/167] perf test session_topology: Delete session->evlist [5.10,039/167] perf dso: Fix memory leak in dso__new_map() [5.10,040/167] perf test maps__merge_in: Fix memory leak of maps [5.10,042/167] perf report: Free generated help strings for sort option [5.10,044/167] perf lzma: Close lzma stream on exit [5.10,046/167] perf data: Close all files in close_dir() [5.10,048/167] ASoC: wm_adsp: Correct wm_coeff_tlv_get handling [5.10,051/167] regulator: hi6421: Use correct variable type for regmap api val argument [5.10,053/167] spi: mediatek: fix fifo rx mode [5.10,055/167] bpf, test: fix NULL pointer dereference on invalid expected_attach_type [5.10,057/167] xdp, net: Fix use-after-free in bpf_xdp_link_release [5.10,059/167] liquidio: Fix unintentional sign extension issue on left shift of u16 [5.10,060/167] s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] [5.10,062/167] bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats [5.10,064/167] bpftool: Check malloc return value in mount_bpffs_for_pin [5.10,068/167] efi/tpm: Differentiate missing and invalid final event log table. [5.10,073/167] sctp: trim optlen when its a huge value in sctp_setsockopt [5.10,074/167] netrom: Decrease sock refcount when sock timers expire [5.10,075/167] scsi: iscsi: Fix iface sysfs attr detection [5.10,078/167] ACPI: Kconfig: Fix table override from built-in initrd [5.10,080/167] bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() [5.10,082/167] bnxt_en: Validate vlan protocol ID on RX packets [5.10,084/167] net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition [5.10,086/167] ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID [5.10,087/167] net: hns3: fix possible mismatches resp of mailbox [5.10,089/167] spi: spi-bcm2835: Fix deadlock [5.10,091/167] ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions [5.10,093/167] nvme-pci: dont WARN_ON in nvme_reset_work if ctrl.state is not RESETTING [5.10,095/167] afs: Fix tracepoint string placement with built-in AFS [5.10,097/167] nvme: set the PRACT bit when using Write Zeroes with T10 PI [5.10,098/167] sctp: update active_key for asoc when old key is being replaced [5.10,099/167] tcp: disable TFO blackhole logic by default [5.10,102/167] drm/panel: raspberrypi-touchscreen: Prevent double-free [5.10,104/167] cifs: fix fallocate when trying to allocate a hole. [5.10,105/167] proc: Avoid mixing integer types in mem_rw() [5.10,107/167] s390/ftrace: fix ftrace_update_ftrace_func implementation [5.10,108/167] s390/boot: fix use of expolines in the DMA code [5.10,109/167] ALSA: usb-audio: Add missing proc text entry for BESPOKEN type [5.10,110/167] ALSA: usb-audio: Add registration quirk for JBL Quantum headsets [5.10,112/167] ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine [5.10,116/167] Revert "usb: renesas-xhci: Fix handling of unknown ROM state" [5.10,117/167] usb: xhci: avoid renesas_usb_fw.mem when its unusable [5.10,118/167] xhci: Fix lost USB 2 remote wake [5.10,120/167] KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state [5.10,123/167] USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS [5.10,126/167] USB: serial: option: add support for u-blox LARA-R6 family [5.10,127/167] USB: serial: cp210x: fix comments for GE CS1000 [5.10,130/167] usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode. [5.10,132/167] usb: typec: stusb160x: register role switch before interrupt registration [5.10,134/167] tracepoints: Update static_call before tp_funcs when adding a tracepoint [5.10,135/167] tracing/histogram: Rename "cpu" to "common_cpu" [5.10,136/167] tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. [5.10,139/167] media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() [5.10,141/167] bus: mhi: core: Validate channel ID when processing command completions [5.10,145/167] io_uring: remove double poll entry on arm failure [5.10,147/167] memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions [5.10,148/167] hugetlbfs: fix mount mode command line processing [5.10,150/167] rbd: always kick acquire on "acquired" and "released" notifications [5.10,153/167] driver core: Prevent warning when removing a device link from unregistered consumer [5.10,154/167] Revert "drm/i915: Propagate errors on awaiting already signaled fences" [5.10,157/167] net: dsa: mv88e6xxx: enable SerDes RX stats for Topaz [5.10,160/167] bonding: fix build issue [5.10,161/167] skbuff: Release nfct refcount on napi stolen or re-used skbs [5.10,166/167] sfc: ensure correct number of XDP queues [5.10,167/167] xhci: add xhci_get_virt_ep() helper

[5.10,017/167] ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops

Commit Message

Patch