net/mlx5e: Skip restore TC rules for vport rep without loaded flag

JIRA: https://issues.redhat.com/browse/RHEL-72226
JIRA: https://issues.redhat.com/browse/RHEL-73517
CVE: CVE-2024-57801
Upstream-status: v6.13-rc6

commit 5a03b36
Author: Jianbo Liu <jianbol@nvidia.com>
Date:   Fri Dec 20 10:15:04 2024 +0200

    net/mlx5e: Skip restore TC rules for vport rep without loaded flag

    During driver unload, unregister_netdev is called after unloading
    vport rep. So, the mlx5e_rep_priv is already freed while trying to get
    rpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free.
    So add the checking to make sure access the data of vport rep which is
    still loaded.

    Fixes: d156953 ("net/mlx5e: Modify and restore TC rules for IPSec TX rules")
    Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
    Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
    Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
    Link: https://patch.msgid.link/20241220081505.1286093-4-tariqt@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Benjamin Poirier <bpoirier@redhat.com>

Author: Benjamin Poirier

drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c

@@ -150,11 +150,11 @@ void mlx5_esw_ipsec_restore_dest_uplink(struct mlx5_core_dev *mdev)
 	unsigned long i;
 	int err;
 
-	xa_for_each(&esw->offloads.vport_reps, i, rep) {
-		rpriv = rep->rep_data[REP_ETH].priv;
-		if (!rpriv || !rpriv->netdev)
+	mlx5_esw_for_each_rep(esw, i, rep) {
+		if (atomic_read(&rep->rep_data[REP_ETH].state) != REP_LOADED)
 			continue;
 
+		rpriv = rep->rep_data[REP_ETH].priv;
 		rhashtable_walk_enter(&rpriv->tc_ht, &iter);
 		rhashtable_walk_start(&iter);
 		while ((flow = rhashtable_walk_next(&iter)) != NULL) {

drivers/net/ethernet/mellanox/mlx5/core/eswitch.h

@@ -714,6 +714,9 @@ void mlx5e_tc_clean_fdb_peer_flows(struct mlx5_eswitch *esw);
 			  MLX5_CAP_GEN_2((esw->dev), ec_vf_vport_base) +\
 			  (last) - 1)
 
+#define mlx5_esw_for_each_rep(esw, i, rep) \
+	xa_for_each(&((esw)->offloads.vport_reps), i, rep)
+
 struct mlx5_eswitch *__must_check
 mlx5_devlink_eswitch_get(struct devlink *devlink);
 

drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c

@@ -53,9 +53,6 @@
 #include "lag/lag.h"
 #include "en/tc/post_meter.h"
 
-#define mlx5_esw_for_each_rep(esw, i, rep) \
-	xa_for_each(&((esw)->offloads.vport_reps), i, rep)
-
 /* There are two match-all miss flows, one for unicast dst mac and
  * one for multicast.
  */