CVE-2024-36007

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mlxsw: spectrum_acl_tcam: Fix warning during rehash<br /> <br /> As previously explained, the rehash delayed work migrates filters from<br /> one region to another. This is done by iterating over all chunks (all<br /> the filters with the same priority) in the region and in each chunk<br /> iterating over all the filters.<br /> <br /> When the work runs out of credits it stores the current chunk and entry<br /> as markers in the per-work context so that it would know where to resume<br /> the migration from the next time the work is scheduled.<br /> <br /> Upon error, the chunk marker is reset to NULL, but without resetting the<br /> entry markers despite being relative to it. This can result in migration<br /> being resumed from an entry that does not belong to the chunk being<br /> migrated. In turn, this will eventually lead to a chunk being iterated<br /> over as if it is an entry. Because of how the two structures happen to<br /> be defined, this does not lead to KASAN splats, but to warnings such as<br /> [1].<br /> <br /> Fix by creating a helper that resets all the markers and call it from<br /> all the places the currently only reset the chunk marker. For good<br /> measures also call it when starting a completely new rehash. Add a<br /> warning to avoid future cases.<br /> <br /> [1]<br /> WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0<br /> Modules linked in:<br /> CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29<br /> Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019<br /> Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work<br /> RIP: 0010:mlxsw_afk_encode+0x242/0x2f0<br /> [...]<br /> Call Trace:<br /> <br /> mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0<br /> mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0<br /> mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290<br /> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470<br /> process_one_work+0x151/0x370<br /> worker_thread+0x2cb/0x3e0<br /> kthread+0xd0/0x100<br /> ret_from_fork+0x34/0x50<br />