In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
qede: sync udp_tunnel ports outside qede_lock in the recovery path<\/p>\n
A TX timeout on a qede NIC that has VXLAN\/GENEVE tunnel ports
\nconfigured wedges the rtnetlink control plane of the whole machine:<\/p>\n
NETDEV WATCHDOG: ens6f1 (qede): transmit queue 2 timed out 10226 ms
\n [qede_tx_timeout:586(ens6f1)]TX timeout on queue 2!
\n [qede_recovery_handler:2665(ens6f0)]Starting a recovery process<\/p>\n
The recovery path deadlocks on the driver’s own mutex:<\/p>\n
qede_sp_task
\n rtnl_lock()
\n mutex_lock(&edev->qede_lock) sync_table == qede_udp_tunnel_sync
\n mutex_lock(&edev->qede_lock) <- same task: deadlock<\/p>\n
The mutex is not recursive, so the kworker blocks on itself with
\nrtnl_lock held, and neither lock is ever released. Every task that
\ncalls rtnl_lock() afterwards (ip, ovs-vswitchd, lldpad, IPv6
\naddrconf, sshd) blocks forever while the node still answers ping.
\nIn a vmcore from an affected production node rtnl_mutex.owner
\ndecodes to the very kworker blocked at the innermost mutex_lock()
\nabove.<\/p>\n
Re-sync the tunnel ports from qede_sp_task() after the internal lock
\nis dropped, still under rtnl_lock as the udp_tunnel API requires.
\nThis mirrors qede_open(), which calls udp_tunnel_nic_reset_ntf()
\nunder rtnl without the internal lock.<\/p>\n
qede_recovery_handler() now returns whether it has successfully
\nreloaded an open device, and the caller re-syncs the ports only in
\nthat case. This keeps the old gating exactly: a device that was down
\nor a failed recovery returns false, as those paths never reached the
\nudp_tunnel_nic_reset_ntf() call before either.<\/p>\n
This was the only user of the qede_lock()\/qede_unlock() helpers, so
\nremove them.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
qede: sync udp_tunnel ports outside qede_lock in the recovery path<\/p>\n
A TX timeout on a qede NIC that has VXLAN\/GENEVE tunnel ports
\nc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7528","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}