CVE-2024-35854

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash<br /> <br /> The rehash delayed work migrates filters from one region to another<br /> according to the number of available credits.<br /> <br /> The migrated from region is destroyed at the end of the work if the<br /> number of credits is non-negative as the assumption is that this is<br /> indicative of migration being complete. This assumption is incorrect as<br /> a non-negative number of credits can also be the result of a failed<br /> migration.<br /> <br /> The destruction of a region that still has filters referencing it can<br /> result in a use-after-free [1].<br /> <br /> Fix by not destroying the region if migration failed.<br /> <br /> [1]<br /> BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230<br /> Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858<br /> <br /> CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5<br /> Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019<br /> Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work<br /> Call Trace:<br /> <br /> dump_stack_lvl+0xc6/0x120<br /> print_report+0xce/0x670<br /> kasan_report+0xd7/0x110<br /> mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230<br /> mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70<br /> mlxsw_sp_acl_atcam_entry_del+0x81/0x210<br /> mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50<br /> mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300<br /> process_one_work+0x8eb/0x19b0<br /> worker_thread+0x6c9/0xf70<br /> kthread+0x2c9/0x3b0<br /> ret_from_fork+0x4d/0x80<br /> ret_from_fork_asm+0x1a/0x30<br /> <br /> <br /> Allocated by task 174:<br /> kasan_save_stack+0x33/0x60<br /> kasan_save_track+0x14/0x30<br /> __kasan_kmalloc+0x8f/0xa0<br /> __kmalloc+0x19c/0x360<br /> mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0<br /> mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300<br /> process_one_work+0x8eb/0x19b0<br /> worker_thread+0x6c9/0xf70<br /> kthread+0x2c9/0x3b0<br /> ret_from_fork+0x4d/0x80<br /> ret_from_fork_asm+0x1a/0x30<br /> <br /> Freed by task 7:<br /> kasan_save_stack+0x33/0x60<br /> kasan_save_track+0x14/0x30<br /> kasan_save_free_info+0x3b/0x60<br /> poison_slab_object+0x102/0x170<br /> __kasan_slab_free+0x14/0x30<br /> kfree+0xc1/0x290<br /> mlxsw_sp_acl_tcam_region_destroy+0x272/0x310<br /> mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300<br /> process_one_work+0x8eb/0x19b0<br /> worker_thread+0x6c9/0xf70<br /> kthread+0x2c9/0x3b0<br /> ret_from_fork+0x4d/0x80<br /> ret_from_fork_asm+0x1a/0x30