CVE-2021-47136

In the Linux kernel, the following vulnerability has been resolved: net:
zero-initialize tc skb extension on allocation Function skb_ext_add()
doesn’t initialize created skb extension with any value and leaves it up to
the user. However, since extension of type TC_SKB_EXT originally contained
only single value tc_skb_ext->chain its users used to just assign the chain
value without setting whole extension memory to zero first. This assumption
changed when TC_SKB_EXT extension was extended with additional fields but
not all users were updated to initialize the new fields which leads to use
of uninitialized memory afterwards. UBSAN log: [ 778.299821] UBSAN:
invalid-load in net/openvswitch/flow.c:899:28 [ 778.301495] load of value
107 is not a valid value for type ‘_Bool’ [ 778.303215] CPU: 0 PID: 0 Comm:
swapper/0 Not tainted 5.12.0-rc7+ #2 [ 778.304933] Hardware name: QEMU
Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 778.307901] Call
Trace: [ 778.308680] <IRQ> [ 778.309358] dump_stack+0xbb/0x107 [
778.310307] ubsan_epilogue+0x5/0x40 [ 778.311167]
__ubsan_handle_load_invalid_value.cold+0x43/0x48 [ 778.312454] ?
memset+0x20/0x40 [ 778.313230] ovs_flow_key_extract.cold+0xf/0x14
[openvswitch] [ 778.314532] ovs_vport_receive+0x19e/0x2e0 [openvswitch] [
778.315749] ? ovs_vport_find_upcall_portid+0x330/0x330 [openvswitch] [
778.317188] ? create_prof_cpu_mask+0x20/0x20 [ 778.318220] ?
arch_stack_walk+0x82/0xf0 [ 778.319153] ?
secondary_startup_64_no_verify+0xb0/0xbb [ 778.320399] ?
stack_trace_save+0x91/0xc0 [ 778.321362] ?
stack_trace_consume_entry+0x160/0x160 [ 778.322517] ?
lock_release+0x52e/0x760 [ 778.323444] netdev_frame_hook+0x323/0x610
[openvswitch] [ 778.324668] ? ovs_netdev_get_vport+0xe0/0xe0 [openvswitch]
[ 778.325950] __netif_receive_skb_core+0x771/0x2db0 [ 778.327067] ?
lock_downgrade+0x6e0/0x6f0 [ 778.328021] ? lock_acquire+0x565/0x720 [
778.328940] ? generic_xdp_tx+0x4f0/0x4f0 [ 778.329902] ?
inet_gro_receive+0x2a7/0x10a0 [ 778.330914] ? lock_downgrade+0x6f0/0x6f0 [
778.331867] ? udp4_gro_receive+0x4c4/0x13e0 [ 778.332876] ?
lock_release+0x52e/0x760 [ 778.333808] ? dev_gro_receive+0xcc8/0x2380 [
778.334810] ? lock_downgrade+0x6f0/0x6f0 [ 778.335769]
__netif_receive_skb_list_core+0x295/0x820 [ 778.336955] ?
process_backlog+0x780/0x780 [ 778.337941] ?
mlx5e_rep_tc_netdevice_event_unregister+0x20/0x20 [mlx5_core] [ 778.339613]
? seqcount_lockdep_reader_access.constprop.0+0xa7/0xc0 [ 778.341033] ?
kvm_clock_get_cycles+0x14/0x20 [ 778.342072]
netif_receive_skb_list_internal+0x5f5/0xcb0 [ 778.343288] ?
__kasan_kmalloc+0x7a/0x90 [ 778.344234] ?
mlx5e_handle_rx_cqe_mpwrq+0x9e0/0x9e0 [mlx5_core] [ 778.345676] ?
mlx5e_xmit_xdp_frame_mpwqe+0x14d0/0x14d0 [mlx5_core] [ 778.347140] ?
__netif_receive_skb_list_core+0x820/0x820 [ 778.348351] ?
mlx5e_post_rx_mpwqes+0xa6/0x25d0 [mlx5_core] [ 778.349688] ?
napi_gro_flush+0x26c/0x3c0 [ 778.350641] napi_complete_done+0x188/0x6b0 [
778.351627] mlx5e_napi_poll+0x373/0x1b80 [mlx5_core] [ 778.352853]
__napi_poll+0x9f/0x510 [ 778.353704] ?
mlx5_flow_namespace_set_mode+0x260/0x260 [mlx5_core] [ 778.355158]
net_rx_action+0x34c/0xa40 [ 778.356060] ? napi_threaded_poll+0x3d0/0x3d0 [
778.357083] ? sched_clock_cpu+0x18/0x190 [ 778.358041] ?
__common_interrupt+0x8e/0x1a0 [ 778.359045] __do_softirq+0x1ce/0x984 [
778.359938] __irq_exit_rcu+0x137/0x1d0 [ 778.360865] irq_exit_rcu+0xa/0x20
[ 778.361708] common_interrupt+0x80/0xa0 [ 778.362640] </IRQ> [ 778.363212]
asm_common_interrupt+0x1e/0x40 [ 778.364204] RIP:
0010:native_safe_halt+0xe/0x10 [ 778.365273] Code: 4f ff ff ff 4c 89 e7 e8
50 3f 40 fe e9 dc fe ff ff 48 89 df e8 43 3f 40 fe eb 90 cc e9 07 00 00 00
0f 00 2d 74 05 62 00 fb f4 <c3> 90 e9 07 00 00 00 0f 00 2d 64 05 62 00 f4
c3 cc cc 0f 1f 44 00 [ 778.369355] RSP: 0018:ffffffff84407e48 EFLAGS:
00000246 [ 778.370570] RAX —truncated—