net/mlx5: fix use after free on Rx queue start
Checks
Commit Message
If RX queue is not started yet, then a mlx5_rxq_obj struct used for
storing HW queue objects will be allocated and added to the list held
in port's private data structure.
After that allocation, Rx queue HW object configuration is done.
If that configuration failed, then mlx5_rxq_obj struct is freed, but
not removed from the list. This causes an use after free bug, during
error handling in mlx5_rxq_start(), where this deallocated struct
was accessed during list cleanup.
This patch fixes that by inserting mlx5_rxq_obj struct to the list only
after HW queue object configuration succeeded.
Fixes: 09c2555303be ("net/mlx5: support shared Rx queue")
Cc: xuemingl@nvidia.com
Cc: stable@dpdk.org
Signed-off-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
---
drivers/net/mlx5/mlx5_trigger.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
Comments
Hi,
> -----Original Message-----
> From: Dariusz Sosnowski <dsosnowski@nvidia.com>
> Sent: Thursday, November 9, 2023 7:58 PM
> To: Matan Azrad <matan@nvidia.com>; Slava Ovsiienko
> <viacheslavo@nvidia.com>; Ori Kam <orika@nvidia.com>; Suanming Mou
> <suanmingm@nvidia.com>; Xueming(Steven) Li <xuemingl@nvidia.com>
> Cc: dev@dpdk.org; Raslan Darawsheh <rasland@nvidia.com>;
> stable@dpdk.org
> Subject: [PATCH] net/mlx5: fix use after free on Rx queue start
>
> If RX queue is not started yet, then a mlx5_rxq_obj struct used for storing HW
> queue objects will be allocated and added to the list held in port's private data
> structure.
> After that allocation, Rx queue HW object configuration is done.
> If that configuration failed, then mlx5_rxq_obj struct is freed, but not removed
> from the list. This causes an use after free bug, during error handling in
> mlx5_rxq_start(), where this deallocated struct was accessed during list
> cleanup.
>
> This patch fixes that by inserting mlx5_rxq_obj struct to the list only after HW
> queue object configuration succeeded.
>
> Fixes: 09c2555303be ("net/mlx5: support shared Rx queue")
> Cc: xuemingl@nvidia.com
> Cc: stable@dpdk.org
>
> Signed-off-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
> Acked-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
Patch applied to next-net-mlx,
Kindest regards,
Raslan Darawsheh
@@ -226,17 +226,17 @@ mlx5_rxq_start(struct rte_eth_dev *dev)
if (rxq == NULL)
continue;
rxq_ctrl = rxq->ctrl;
- if (!rxq_ctrl->started) {
+ if (!rxq_ctrl->started)
if (mlx5_rxq_ctrl_prepare(dev, rxq_ctrl, i) < 0)
goto error;
- LIST_INSERT_HEAD(&priv->rxqsobj, rxq_ctrl->obj, next);
- }
ret = priv->obj_ops.rxq_obj_new(rxq);
if (ret) {
mlx5_free(rxq_ctrl->obj);
rxq_ctrl->obj = NULL;
goto error;
}
+ if (!rxq_ctrl->started)
+ LIST_INSERT_HEAD(&priv->rxqsobj, rxq_ctrl->obj, next);
rxq_ctrl->started = true;
}
return 0;