From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, syzkaller <syzkaller@googlegroups.com>,
Boris Pismenny <borisp@mellanox.com>,
Leon Romanovsky <leon@kernel.org>,
Doug Ledford <dledford@redhat.com>
Subject: [PATCH 4.14 70/77] IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq
Date: Fri, 23 Mar 2018 10:54:44 +0100 [thread overview]
Message-ID: <20180323094146.974649817@linuxfoundation.org> (raw)
In-Reply-To: <20180323094142.260022880@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Pismenny <borisp@mellanox.com>
commit 2c292dbb398ee46fc1343daf6c3cf9715a75688e upstream.
Add a check for the length of the qpin structure to prevent out-of-bounds reads
BUG: KASAN: slab-out-of-bounds in create_raw_packet_qp+0x114c/0x15e2
Read of size 8192 at addr ffff880066b99290 by task syz-executor3/549
CPU: 3 PID: 549 Comm: syz-executor3 Not tainted 4.15.0-rc2+ #27 Hardware
name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Call Trace:
dump_stack+0x8d/0xd4
print_address_description+0x73/0x290
kasan_report+0x25c/0x370
? create_raw_packet_qp+0x114c/0x15e2
memcpy+0x1f/0x50
create_raw_packet_qp+0x114c/0x15e2
? create_raw_packet_qp_tis.isra.28+0x13d/0x13d
? lock_acquire+0x370/0x370
create_qp_common+0x2245/0x3b50
? destroy_qp_user.isra.47+0x100/0x100
? kasan_kmalloc+0x13d/0x170
? sched_clock_cpu+0x18/0x180
? fs_reclaim_acquire.part.15+0x5/0x30
? __lock_acquire+0xa11/0x1da0
? sched_clock_cpu+0x18/0x180
? kmem_cache_alloc_trace+0x17e/0x310
? mlx5_ib_create_qp+0x30e/0x17b0
mlx5_ib_create_qp+0x33d/0x17b0
? sched_clock_cpu+0x18/0x180
? create_qp_common+0x3b50/0x3b50
? lock_acquire+0x370/0x370
? __radix_tree_lookup+0x180/0x220
? uverbs_try_lock_object+0x68/0xc0
? rdma_lookup_get_uobject+0x114/0x240
create_qp.isra.5+0xce4/0x1e20
? ib_uverbs_ex_create_cq_cb+0xa0/0xa0
? copy_ah_attr_from_uverbs.isra.2+0xa00/0xa00
? ib_uverbs_cq_event_handler+0x160/0x160
? __might_fault+0x17c/0x1c0
ib_uverbs_create_qp+0x21b/0x2a0
? ib_uverbs_destroy_cq+0x2e0/0x2e0
ib_uverbs_write+0x55a/0xad0
? ib_uverbs_destroy_cq+0x2e0/0x2e0
? ib_uverbs_destroy_cq+0x2e0/0x2e0
? ib_uverbs_open+0x760/0x760
? futex_wake+0x147/0x410
? check_prev_add+0x1680/0x1680
? do_futex+0x3d3/0xa60
? sched_clock_cpu+0x18/0x180
__vfs_write+0xf7/0x5c0
? ib_uverbs_open+0x760/0x760
? kernel_read+0x110/0x110
? lock_acquire+0x370/0x370
? __fget+0x264/0x3b0
vfs_write+0x18a/0x460
SyS_write+0xc7/0x1a0
? SyS_read+0x1a0/0x1a0
? trace_hardirqs_on_thunk+0x1a/0x1c
entry_SYSCALL_64_fastpath+0x18/0x85
RIP: 0033:0x4477b9
RSP: 002b:00007f1822cadc18 EFLAGS: 00000292 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004477b9
RDX: 0000000000000070 RSI: 000000002000a000 RDI: 0000000000000005
RBP: 0000000000708000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 00000000ffffffff
R13: 0000000000005d70 R14: 00000000006e6e30 R15: 0000000020010ff0
Allocated by task 549:
__kmalloc+0x15e/0x340
kvmalloc_node+0xa1/0xd0
create_user_qp.isra.46+0xd42/0x1610
create_qp_common+0x2e63/0x3b50
mlx5_ib_create_qp+0x33d/0x17b0
create_qp.isra.5+0xce4/0x1e20
ib_uverbs_create_qp+0x21b/0x2a0
ib_uverbs_write+0x55a/0xad0
__vfs_write+0xf7/0x5c0
vfs_write+0x18a/0x460
SyS_write+0xc7/0x1a0
entry_SYSCALL_64_fastpath+0x18/0x85
Freed by task 368:
kfree+0xeb/0x2f0
kernfs_fop_release+0x140/0x180
__fput+0x266/0x700
task_work_run+0x104/0x180
exit_to_usermode_loop+0xf7/0x110
syscall_return_slowpath+0x298/0x370
entry_SYSCALL_64_fastpath+0x83/0x85
The buggy address belongs to the object at ffff880066b99180 which
belongs to the cache kmalloc-512 of size 512 The buggy address is
located 272 bytes inside of 512-byte region [ffff880066b99180,
ffff880066b99380) The buggy address belongs to the page:
page:000000006040eedd count:1 mapcount:0 mapping: (null)
index:0x0 compound_mapcount: 0
flags: 0x4000000000008100(slab|head)
raw: 4000000000008100 0000000000000000 0000000000000000 0000000180190019
raw: ffffea00019a7500 0000000b0000000b ffff88006c403080 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff880066b99180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff880066b99200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff880066b99280: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff880066b99300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880066b99380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: 0fb2ed66a14c ("IB/mlx5: Add create and destroy functionality for Raw Packet QP")
Signed-off-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/qp.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1130,7 +1130,7 @@ static void destroy_raw_packet_qp_sq(str
ib_umem_release(sq->ubuffer.umem);
}
-static int get_rq_pas_size(void *qpc)
+static size_t get_rq_pas_size(void *qpc)
{
u32 log_page_size = MLX5_GET(qpc, qpc, log_page_size) + 12;
u32 log_rq_stride = MLX5_GET(qpc, qpc, log_rq_stride);
@@ -1146,7 +1146,8 @@ static int get_rq_pas_size(void *qpc)
}
static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
- struct mlx5_ib_rq *rq, void *qpin)
+ struct mlx5_ib_rq *rq, void *qpin,
+ size_t qpinlen)
{
struct mlx5_ib_qp *mqp = rq->base.container_mibqp;
__be64 *pas;
@@ -1155,9 +1156,12 @@ static int create_raw_packet_qp_rq(struc
void *rqc;
void *wq;
void *qpc = MLX5_ADDR_OF(create_qp_in, qpin, qpc);
- int inlen;
+ size_t rq_pas_size = get_rq_pas_size(qpc);
+ size_t inlen;
int err;
- u32 rq_pas_size = get_rq_pas_size(qpc);
+
+ if (qpinlen < rq_pas_size + MLX5_BYTE_OFF(create_qp_in, pas))
+ return -EINVAL;
inlen = MLX5_ST_SZ_BYTES(create_rq_in) + rq_pas_size;
in = kvzalloc(inlen, GFP_KERNEL);
@@ -1236,7 +1240,7 @@ static void destroy_raw_packet_qp_tir(st
}
static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
- u32 *in,
+ u32 *in, size_t inlen,
struct ib_pd *pd)
{
struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
@@ -1266,7 +1270,7 @@ static int create_raw_packet_qp(struct m
if (qp->flags & MLX5_IB_QP_CVLAN_STRIPPING)
rq->flags |= MLX5_IB_RQ_CVLAN_STRIPPING;
- err = create_raw_packet_qp_rq(dev, rq, in);
+ err = create_raw_packet_qp_rq(dev, rq, in, inlen);
if (err)
goto err_destroy_sq;
@@ -1781,11 +1785,16 @@ static int create_qp_common(struct mlx5_
qp->flags |= MLX5_IB_QP_LSO;
}
+ if (inlen < 0) {
+ err = -EINVAL;
+ goto err;
+ }
+
if (init_attr->qp_type == IB_QPT_RAW_PACKET ||
qp->flags & MLX5_IB_QP_UNDERLAY) {
qp->raw_packet_qp.sq.ubuffer.buf_addr = ucmd.sq_buf_addr;
raw_packet_qp_copy_info(qp, &qp->raw_packet_qp);
- err = create_raw_packet_qp(dev, qp, in, pd);
+ err = create_raw_packet_qp(dev, qp, in, inlen, pd);
} else {
err = mlx5_core_create_qp(dev->mdev, &base->mqp, in, inlen);
}
@@ -1825,6 +1834,7 @@ err_create:
else if (qp->create_type == MLX5_QP_KERNEL)
destroy_qp_kernel(dev, qp);
+err:
kvfree(in);
return err;
}
next prev parent reply other threads:[~2018-03-23 10:03 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-23 9:53 [PATCH 4.14 00/77] 4.14.30-stable review Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 01/77] scsi: megaraid_sas: Do not use 32-bit atomic request descriptor for Ventura controllers Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 02/77] staging: android: ashmem: Fix possible deadlock in ashmem_ioctl Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 03/77] Bluetooth: hci_qca: Avoid setup failure on missing rampatch Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 04/77] Bluetooth: btqcomsmd: Fix skb double free corruption Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 05/77] cpufreq: longhaul: Revert transition_delay_us to 200 ms Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 06/77] media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 07/77] drm/msm: fix leak in failed get_pages Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 08/77] net: fec: add phy_reset_after_clk_enable() support Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 09/77] RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 10/77] hv_netvsc: Fix the receive buffer size limit Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 11/77] hv_netvsc: Fix the TX/RX buffer default sizes Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 12/77] spi: sh-msiof: Avoid writing to registers from spi_master.setup() Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 13/77] rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 14/77] rtlwifi: always initialize variables given to RT_TRACE() Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 15/77] media: bt8xx: Fix err bt878_probe() Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 16/77] ath10k: handling qos at STA side based on AP WMM enable/disable Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 17/77] media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 18/77] qmi_wwan: set FLAG_SEND_ZLP to avoid network initiated disconnect Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 19/77] tty: goldfish: Enable earlycon only if built-in Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 20/77] serial: 8250_dw: Disable clock on error Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 21/77] cros_ec: fix nul-termination for firmware build info Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 22/77] watchdog: Fix potential kref imbalance when opening watchdog Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 23/77] watchdog: Fix kref imbalance seen if handle_boot_enabled=0 Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 24/77] platform/chrome: Use proper protocol transfer function Greg Kroah-Hartman
2018-03-23 9:53 ` [PATCH 4.14 25/77] dmaengine: zynqmp_dma: Fix race condition in the probe Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 26/77] drm/tilcdc: ensure nonatomic iowrite64 is not used Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 27/77] mmc: avoid removing non-removable hosts during suspend Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 28/77] mmc: block: fix logical error to avoid memory leak Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 29/77] /dev/mem: Add bounce buffer for copy-out Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 30/77] net: phy: meson-gxl: check phy_write return value Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 31/77] sfp: fix EEPROM reading in the case of non-SFF8472 SFPs Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 32/77] sfp: fix non-detection of PHY Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 33/77] media: s5p-mfc: Fix lock contention - request_firmware() once Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 34/77] rtc: ac100: Fix multiple race conditions Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 35/77] IB/ipoib: Avoid memory leak if the SA returns a different DGID Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 36/77] RDMA/cma: Use correct size when writing netlink stats Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 37/77] IB/umem: Fix use of npages/nmap fields Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 38/77] iser-target: avoid reinitializing rdma contexts for isert commands Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 39/77] vgacon: Set VGA struct resource types Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 40/77] omapdrm: panel: fix compatible vendor string for td028ttec1 Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 41/77] mmc: sdhci-xenon: wait 5ms after set 1.8V signal enable Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 42/77] drm/omap: DMM: Check for DMM readiness after successful transaction commit Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 43/77] pty: cancel pty slave port bufs work in tty_release Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 44/77] coresight: Fix disabling of CoreSight TPIU Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 45/77] PCI: designware-ep: Fix ->get_msi() to check MSI_EN bit Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 46/77] PCI: endpoint: Fix find_first_zero_bit() usage Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 47/77] PCI: rcar: Handle rcar_pcie_parse_request_of_pci_ranges() failures Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 48/77] media: davinci: fix a debug printk Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 49/77] pinctrl: Really force states during suspend/resume Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 50/77] pinctrl: rockchip: enable clock when reading pin direction register Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 51/77] iommu/vt-d: clean up pr_irq if request_threaded_irq fails Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 52/77] ip6_vti: adjust vti mtu according to mtu of lower device Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 53/77] ip_gre: fix error path when erspan_rcv failed Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 54/77] ip_gre: fix potential memory leak in erspan_rcv Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 55/77] soc: qcom: smsm: fix child-node lookup Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 56/77] scsi: lpfc: Fix SCSI LUN discovery when SCSI and NVME enabled Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 57/77] scsi: lpfc: Fix issues connecting with nvme initiator Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 58/77] RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 59/77] ARM: dts: aspeed-evb: Add unit name to memory node Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 60/77] nfsd4: permit layoutget of executable-only files Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 61/77] clk: at91: pmc: Wait for clocks when resuming Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 62/77] clk: Dont touch hardware when reparenting during registration Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 63/77] clk: axi-clkgen: Correctly handle nocount bit in recalc_rate() Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 64/77] clk: si5351: Rename internal plls to avoid name collisions Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 65/77] crypto: artpec6 - set correct iv size for gcm(aes) Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 66/77] dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 67/77] scsi: mpt3sas: fix oops in error handlers after shutdown/unload Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 68/77] scsi: mpt3sas: wait for and flush running commands on shutdown/unload Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 69/77] IB/mlx5: Fix integer overflows in mlx5_ib_create_srq Greg Kroah-Hartman
2018-03-23 9:54 ` Greg Kroah-Hartman [this message]
2018-03-23 9:54 ` [PATCH 4.14 71/77] serial: 8250_pci: Dont fail on multiport card class Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 72/77] RDMA/core: Do not use invalid destination in determining port reuse Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 73/77] clk: migrate the count of orphaned clocks at init Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 74/77] RDMA/ucma: Fix access to non-initialized CM_ID object Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 75/77] RDMA/ucma: Dont allow join attempts for unsupported AF family Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 76/77] kbuild: fix linker feature test macros when cross compiling with Clang Greg Kroah-Hartman
2018-03-23 9:54 ` [PATCH 4.14 77/77] RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file Greg Kroah-Hartman
2018-03-23 15:40 ` [PATCH 4.14 00/77] 4.14.30-stable review kernelci.org bot
2018-03-23 20:47 ` Shuah Khan
2018-03-24 0:11 ` Guenter Roeck
2018-03-24 16:17 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180323094146.974649817@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=borisp@mellanox.com \
--cc=dledford@redhat.com \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome