CVE-2024-35853

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mlxsw: spectrum_acl_tcam: Fix memory leak during rehash<br /> <br /> The rehash delayed work migrates filters from one region to another.<br /> This is done by iterating over all chunks (all the filters with the same<br /> priority) in the region and in each chunk iterating over all the<br /> filters.<br /> <br /> If the migration fails, the code tries to migrate the filters back to<br /> the old region. However, the rollback itself can also fail in which case<br /> another migration will be erroneously performed. Besides the fact that<br /> this ping pong is not a very good idea, it also creates a problem.<br /> <br /> Each virtual chunk references two chunks: The currently used one<br /> (&amp;#39;vchunk-&gt;chunk&amp;#39;) and a backup (&amp;#39;vchunk-&gt;chunk2&amp;#39;). During migration the<br /> first holds the chunk we want to migrate filters to and the second holds<br /> the chunk we are migrating filters from.<br /> <br /> The code currently assumes - but does not verify - that the backup chunk<br /> does not exist (NULL) if the currently used chunk does not reference the<br /> target region. This assumption breaks when we are trying to rollback a<br /> rollback, resulting in the backup chunk being overwritten and leaked<br /> [1].<br /> <br /> Fix by not rolling back a failed rollback and add a warning to avoid<br /> future cases.<br /> <br /> [1]<br /> WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20<br /> Modules linked in:<br /> CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14<br /> Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019<br /> Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work<br /> RIP: 0010:parman_destroy+0x17/0x20<br /> [...]<br /> Call Trace:<br /> <br /> mlxsw_sp_acl_atcam_region_fini+0x19/0x60<br /> mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0<br /> mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470<br /> process_one_work+0x151/0x370<br /> worker_thread+0x2cb/0x3e0<br /> kthread+0xd0/0x100<br /> ret_from_fork+0x34/0x50<br /> ret_from_fork_asm+0x1a/0x30<br />