CVE-2024-35855

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update<br /> <br /> The rule activity update delayed work periodically traverses the list of<br /> configured rules and queries their activity from the device.<br /> <br /> As part of this task it accesses the entry pointed by &amp;#39;ventry-&gt;entry&amp;#39;,<br /> but this entry can be changed concurrently by the rehash delayed work,<br /> leading to a use-after-free [1].<br /> <br /> Fix by closing the race and perform the activity query under the<br /> &amp;#39;vregion-&gt;lock&amp;#39; mutex.<br /> <br /> [1]<br /> BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140<br /> Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181<br /> <br /> CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2<br /> Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019<br /> Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work<br /> Call Trace:<br /> <br /> dump_stack_lvl+0xc6/0x120<br /> print_report+0xce/0x670<br /> kasan_report+0xd7/0x110<br /> mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140<br /> mlxsw_sp_acl_rule_activity_update_work+0x219/0x400<br /> process_one_work+0x8eb/0x19b0<br /> worker_thread+0x6c9/0xf70<br /> kthread+0x2c9/0x3b0<br /> ret_from_fork+0x4d/0x80<br /> ret_from_fork_asm+0x1a/0x30<br /> <br /> <br /> Allocated by task 1039:<br /> kasan_save_stack+0x33/0x60<br /> kasan_save_track+0x14/0x30<br /> __kasan_kmalloc+0x8f/0xa0<br /> __kmalloc+0x19c/0x360<br /> mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0<br /> mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50<br /> mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300<br /> process_one_work+0x8eb/0x19b0<br /> worker_thread+0x6c9/0xf70<br /> kthread+0x2c9/0x3b0<br /> ret_from_fork+0x4d/0x80<br /> ret_from_fork_asm+0x1a/0x30<br /> <br /> Freed by task 1039:<br /> kasan_save_stack+0x33/0x60<br /> kasan_save_track+0x14/0x30<br /> kasan_save_free_info+0x3b/0x60<br /> poison_slab_object+0x102/0x170<br /> __kasan_slab_free+0x14/0x30<br /> kfree+0xc1/0x290<br /> mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50<br /> mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300<br /> process_one_work+0x8eb/0x19b0<br /> worker_thread+0x6c9/0xf70<br /> kthread+0x2c9/0x3b0<br /> ret_from_fork+0x4d/0x80<br /> ret_from_fork_asm+0x1a/0x30