Andrew Lukoshko
0eab958d1f
Add the RHEL 211.21.1..211.22.1 backports (1288-1351) from centos-stream-10 and upstream stable, on top of 211.20.1. Bump pkgrelease and specrelease to 211.22.1. (The redhat/ automotive rebuild-changelog tooling change is omitted: it patches redhat/scripts not present in this build base and does not affect the kernel.)
139 lines
5.2 KiB
Diff
139 lines
5.2 KiB
Diff
From 9837d44c3a8c7908fca4a3e4ef2e753b43b2e7da Mon Sep 17 00:00:00 2001
|
|
From: Michal Schmidt <mschmidt@redhat.com>
|
|
Date: Mon, 27 Apr 2026 17:18:26 +0200
|
|
Subject: [PATCH] ice: fix stats array overflow when VF requests more queues
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-163186
|
|
|
|
Upstream status: Posted: https://lore.kernel.org/netdev/20260427151827.43342-1-mschmidt@redhat.com/
|
|
|
|
When a VF increases its queue count via VIRTCHNL_OP_REQUEST_QUEUES,
|
|
ice_vc_request_qs_msg() sets vf->num_req_qs and triggers a VF reset.
|
|
The reset calls ice_vf_reconfig_vsi(), which does ice_vsi_decfg()
|
|
followed by ice_vsi_cfg(). ice_vsi_decfg() does not free the per-ring
|
|
stats arrays. Inside ice_vsi_cfg_def(), ice_vsi_set_num_qs() updates
|
|
alloc_txq/alloc_rxq to the new larger value, but
|
|
ice_vsi_alloc_stat_arrays() returns early because the stats already
|
|
exist. ice_vsi_alloc_ring_stats() then iterates using the new larger
|
|
alloc_txq and writes beyond the bounds of the old, smaller
|
|
tx_ring_stats/rx_ring_stats pointer arrays, corrupting adjacent SLUB
|
|
metadata.
|
|
|
|
KASAN detects the bug:
|
|
==================================================================
|
|
BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice]
|
|
Read of size 8 at addr ffff88810affea60 by task kworker/u131:7/221
|
|
|
|
CPU: 24 UID: 0 PID: 221 Comm: kworker/u131:7 Not tainted 7.1.0-rc1+ #1 PREEMPT(lazy)
|
|
...
|
|
Workqueue: ice ice_service_task [ice]
|
|
Call Trace:
|
|
<TASK>
|
|
...
|
|
kasan_report+0xd7/0x120
|
|
ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice]
|
|
ice_vsi_cfg_def+0x12e2/0x2060 [ice]
|
|
ice_vsi_cfg+0xb5/0x3c0 [ice]
|
|
ice_reset_vf+0x858/0xf80 [ice]
|
|
ice_vc_request_qs_msg+0x1da/0x290 [ice]
|
|
ice_vc_process_vf_msg+0xb15/0x1430 [ice]
|
|
__ice_clean_ctrlq+0x70d/0x9d0 [ice]
|
|
ice_service_task+0x840/0xf20 [ice]
|
|
process_one_work+0x690/0xff0
|
|
worker_thread+0x4d9/0xd20
|
|
kthread+0x322/0x410
|
|
ret_from_fork+0x332/0x660
|
|
ret_from_fork_asm+0x1a/0x30
|
|
</TASK>
|
|
|
|
Allocated by task 2439:
|
|
kasan_save_stack+0x1c/0x40
|
|
kasan_save_track+0x10/0x30
|
|
__kasan_kmalloc+0x96/0xb0
|
|
__kmalloc_noprof+0x1d8/0x580
|
|
ice_vsi_cfg_def+0x115c/0x2060 [ice]
|
|
ice_vsi_cfg+0xb5/0x3c0 [ice]
|
|
ice_vsi_setup+0x180/0x320 [ice]
|
|
ice_start_vfs+0x1f3/0x590 [ice]
|
|
ice_ena_vfs+0x66d/0x798 [ice]
|
|
ice_sriov_configure.cold+0xe4/0x121 [ice]
|
|
sriov_numvfs_store+0x279/0x480
|
|
kernfs_fop_write_iter+0x331/0x4f0
|
|
vfs_write+0x4c4/0xe40
|
|
ksys_write+0x10c/0x240
|
|
do_syscall_64+0xd9/0x650
|
|
entry_SYSCALL_64_after_hwframe+0x76/0x7e
|
|
|
|
The buggy address belongs to the object at ffff88810affea40
|
|
which belongs to the cache kmalloc-32 of size 32
|
|
The buggy address is located 0 bytes to the right of
|
|
allocated 32-byte region [ffff88810affea40, ffff88810affea60)
|
|
...
|
|
==================================================================
|
|
|
|
ice_vsi_rebuild() handles this correctly by calling
|
|
ice_vsi_realloc_stat_arrays() before reconfiguration, but
|
|
ice_vf_reconfig_vsi() was missing this call.
|
|
|
|
Fix by calling ice_vsi_realloc_stat_arrays() in ice_vf_reconfig_vsi()
|
|
before ice_vsi_decfg(), mirroring the ice_vsi_rebuild() pattern. Set
|
|
vsi->req_txq/req_rxq from vf->num_req_qs so the realloc function knows
|
|
the target array size.
|
|
|
|
See the linked RHEL Jira item for a reproducer.
|
|
|
|
Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()")
|
|
Closes: https://redhat.atlassian.net/browse/RHEL-164321
|
|
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
|
|
Assisted-by: Claude:claude-opus-4-6 semcode
|
|
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
|
|
Reviewed-by: Simon Horman <horms@kernel.org>
|
|
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
|
|
|
|
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
|
|
index 26496eaed981..7bc5a7009cbb 100644
|
|
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
|
|
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
|
|
@@ -3017,7 +3017,7 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi,
|
|
* ice_vsi_realloc_stat_arrays - Frees unused stat structures or alloc new ones
|
|
* @vsi: VSI pointer
|
|
*/
|
|
-static int
|
|
+int
|
|
ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi)
|
|
{
|
|
u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq;
|
|
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.h b/drivers/net/ethernet/intel/ice/ice_lib.h
|
|
index 2cb1eb98b9da..fce6f633f506 100644
|
|
--- a/drivers/net/ethernet/intel/ice/ice_lib.h
|
|
+++ b/drivers/net/ethernet/intel/ice/ice_lib.h
|
|
@@ -66,6 +66,7 @@ int ice_ena_vsi(struct ice_vsi *vsi, bool locked);
|
|
void ice_vsi_decfg(struct ice_vsi *vsi);
|
|
void ice_dis_vsi(struct ice_vsi *vsi, bool locked);
|
|
|
|
+int ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi);
|
|
int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags);
|
|
int ice_vsi_cfg(struct ice_vsi *vsi);
|
|
struct ice_vsi *ice_vsi_alloc(struct ice_pf *pf);
|
|
diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
|
|
index de9e81ccee66..fd71dd10eb38 100644
|
|
--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
|
|
+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
|
|
@@ -268,6 +268,13 @@ static int ice_vf_reconfig_vsi(struct ice_vf *vf)
|
|
|
|
vsi->flags = ICE_VSI_FLAG_NO_INIT;
|
|
|
|
+ vsi->req_txq = vf->num_req_qs;
|
|
+ vsi->req_rxq = vf->num_req_qs;
|
|
+
|
|
+ err = ice_vsi_realloc_stat_arrays(vsi);
|
|
+ if (err)
|
|
+ return err;
|
|
+
|
|
ice_vsi_decfg(vsi);
|
|
ice_fltr_remove_all(vsi);
|
|
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|