Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en/rep): The neighbour-update worker takes a reference on an

Impact

The neighbour-update worker takes a reference on an encapsulation entry that a concurrent TC filter update is already freeing. KASAN reports a use-after-free while the worker is deciding which hardware encap rule to reprogram, so freed memory influences the steering state of the shared eswitch and the node crashes.

Who can reach it

Two concurrent drivers are needed and both are cheap to supply: neighbour (ARP/ND) churn from a host on the fabric - including a tenant VM with an address on the same segment - and concurrent TC filter add/delete from the host's offload agent. Requires switchdev/eswitch mode with tunnel-encap TC offload, the standard configuration for OVS hardware offload on a multi-tenant node.

What to do

Update to a patched kernel on your stream. Interim: disable hw-tc-offload on the mlx5 uplink or stop offloading tunnel-encap rules, and keep untrusted tenants off the L2 segment that feeds neighbour updates.

References