[PATCH net 3/3] net/mlx5: DR, Fix out-of-bounds write when sync to HW fails

[Tariq Toukan]

From: Yevgeny Kliteynik <kliteyn@xxxxxxxxxx>

mlx5dr_icm_free_chunk() moves a freed chunk to the "hot" chunks array by
writing it to hot_chunks_arr and, once the accumulated hot memory
crosses a threshold, triggers a sync to HW that flushes the array.  The
array is large enough to hold the chunks of a single accumulation cycle,
and relies on the sync path to flush it.

However, if sync to HW fails, hot chunks array is not cleared, and every
subsequent mlx5dr_icm_free_chunk will write past the end of
hot_chunks_arr, resulting in an out-of-bounds write and kernel heap
corruption.

A failed sync to HW also means it is no longer safe to recycle ICM: a
chunk's memory may only be returned to the buddy allocator (and thus be
reused) after a sync has confirmed that HW no longer references it.

Fix both problems by putting the pool into an error state when a sync to
HW fails - mlx5dr_icm_free_chunk() stops queuing freed chunks, so it
never writes past hot_chunks_arr. The chunk's ICM memory is not returned
to the buddy allocator (HW may still reference it); the segment is left
reserved and is reclaimed when the pool is destroyed.

Fixes: 4519fc45beeb ("net/mlx5: DR, Keep track of hot ICM chunks in an array instead of list")
Signed-off-by: Yevgeny Kliteynik <kliteyn@xxxxxxxxxx>
Reviewed-by: Alex Vesker <valex@xxxxxxxxxx>
Signed-off-by: Tariq Toukan <tariqt@xxxxxxxxxx>
---
 .../mlx5/core/steering/sws/dr_icm_pool.c      | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_icm_pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_icm_pool.c
index 1b928b40686e..375ab8c2043f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_icm_pool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_icm_pool.c
@@ -33,6 +33,10 @@ struct mlx5dr_icm_pool {
 	u64 hot_memory_size;
 	/* hot memory size threshold for triggering sync */
 	u64 th;
+	/* Set when a sync to HW fails - no new chunks are served,
+	 * and freed chunks are no longer queued.
+	 */
+	bool sync_failed;
 };
 
 struct mlx5dr_icm_dm {
@@ -369,6 +373,12 @@ static int dr_icm_pool_sync_all_buddy_pools(struct mlx5dr_icm_pool *pool)
 	err = mlx5dr_cmd_sync_steering(pool->dmn->mdev);
 	if (err) {
 		mlx5dr_err(pool->dmn, "Failed to sync to HW (err: %d)\n", err);
+		/* The hot chunks could not be flushed. Put the pool in an error
+		 * state so that no further chunks are queued (which would
+		 * overflow hot_chunks_arr) or served (which could reuse ICM
+		 * that HW may still reference).
+		 */
+		pool->sync_failed = true;
 		return err;
 	}
 
@@ -475,6 +485,14 @@ void mlx5dr_icm_free_chunk(struct mlx5dr_icm_chunk *chunk)
 	/* move the chunk to the waiting chunks array, AKA "hot" memory */
 	mutex_lock(&pool->mutex);
 
+	/* If a previous sync to HW failed, the pool is in an error state.
+	 * The chunk must not be queued. ICM memory is not returned to the
+	 * buddy allocator - it is reclaimed only when the pool is destroyed.
+	 * Just free the chunk's bookkeeping struct.
+	 */
+	if (pool->sync_failed)
+		goto out;
+
 	pool->hot_memory_size += mlx5dr_icm_pool_get_chunk_byte_size(chunk);
 
 	hot_chunk = &pool->hot_chunks_arr[pool->hot_chunks_num++];
@@ -482,12 +500,13 @@ void mlx5dr_icm_free_chunk(struct mlx5dr_icm_chunk *chunk)
 	hot_chunk->seg = chunk->seg;
 	hot_chunk->size = chunk->size;
 
-	kmem_cache_free(chunks_cache, chunk);
-
 	/* Check if we have chunks that are waiting for sync-ste */
 	if (dr_icm_pool_is_sync_required(pool))
 		dr_icm_pool_sync_all_buddy_pools(pool);
 
+out:
+	kmem_cache_free(chunks_cache, chunk);
+
 	mutex_unlock(&pool->mutex);
 }
 
-- 
2.44.0