In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/mlx5e: TC, Check if flow is PEER before acquiring devcom lock<\/p>\n
In case __mlx5e_add_fdb_flow() fails in lower levels, the flow is
\ndeleted via mlx5e_tc_del_flow(), and mlx5e_tc_del_flow() is acquiring
\nESW devcom lock without condition. In addition, in case of peer_flow,
\n__mlx5e_add_fdb_flow() is called while holding ESW devcom comp lock.
\nThis results in an AA deadlock.<\/p>\n
To fix this, introduce a new PEER flag that is set on flows created as
\npeer flows (the duplicate flows on peer devices), and check it in
\nmlx5e_tc_del_flow() before acquiring ESW devcom lock.<\/p>\n
Lockdep splat:
\n============================================
\nWARNING: possible recursive locking detected
\n============================================
\n Possible unsafe locking scenario:
\n CPU0
\n —-
\n lock(&comp->lock_key#2);
\n lock(&comp->lock_key#2);
\n *** DEADLOCK ***
\nCall Trace:<\/p>\n
dump_stack_lvl+0x69\/0xa0
\n print_deadlock_bug.cold+0xbd\/0xca
\n __lock_acquire+0x1671\/0x2ec0
\n lock_acquire+0x10e\/0x2e0
\n down_read+0x95\/0x430
\n mlx5_devcom_for_each_peer_begin+0x4e\/0xe0 [mlx5_core]
\n mlx5e_tc_del_flow+0x11d\/0xa70 [mlx5_core]
\n mlx5e_flow_put+0x99\/0x100 [mlx5_core]
\n __mlx5e_add_fdb_flow+0x409\/0xf00 [mlx5_core]
\n mlx5e_configure_flower+0x2a86\/0x4100 [mlx5_core]
\n mlx5e_rep_setup_tc_cls_flower+0x12f\/0x1b0 [mlx5_core]
\n mlx5e_rep_setup_tc_cb+0x153\/0x750 [mlx5_core]
\n tc_setup_cb_add+0x1dc\/0x470
\n fl_change+0x2f4d\/0x626d [cls_flower]
\n tc_new_tfilter+0x79b\/0x2310
\n rtnetlink_rcv_msg+0x778\/0xad0
\n do_syscall_64+0x70\/0x960
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/mlx5e: TC, Check if flow is PEER before acquiring devcom lock<\/p>\n
In case __mlx5e_add_fdb_flow() fails in lower levels, the flow i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-3391","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/3391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}