mirror of
https://github.com/torvalds/linux.git
synced 2024-11-29 07:31:29 +00:00
305d568b72
The FSM can run in a circle allowing rdma_resolve_ip() to be called twice
on the same id_priv. While this cannot happen without going through the
work, it violates the invariant that the same address resolution
background request cannot be active twice.
CPU 1 CPU 2
rdma_resolve_addr():
RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY
rdma_resolve_ip(addr_handler) #1
process_one_req(): for #1
addr_handler():
RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND
mutex_unlock(&id_priv->handler_mutex);
[.. handler still running ..]
rdma_resolve_addr():
RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY
rdma_resolve_ip(addr_handler)
!! two requests are now on the req_list
rdma_destroy_id():
destroy_id_handler_unlock():
_destroy_id():
cma_cancel_operation():
rdma_addr_cancel()
// process_one_req() self removes it
spin_lock_bh(&lock);
cancel_delayed_work(&req->work);
if (!list_empty(&req->list)) == true
! rdma_addr_cancel() returns after process_on_req #1 is done
kfree(id_priv)
process_one_req(): for #2
addr_handler():
mutex_lock(&id_priv->handler_mutex);
!! Use after free on id_priv
rdma_addr_cancel() expects there to be one req on the list and only
cancels the first one. The self-removal behavior of the work only happens
after the handler has returned. This yields a situations where the
req_list can have two reqs for the same "handle" but rdma_addr_cancel()
only cancels the first one.
The second req remains active beyond rdma_destroy_id() and will
use-after-free id_priv once it inevitably triggers.
Fix this by remembering if the id_priv has called rdma_resolve_ip() and
always cancel before calling it again. This ensures the req_list never
gets more than one item in it and doesn't cost anything in the normal flow
that never uses this strange error path.
Link: https://lore.kernel.org/r/0-v1-3bc675b8006d+22-syz_cancel_uaf_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes: e51060f08a ("IB: IP address based RDMA connection manager")
Reported-by: syzbot+dc3dfba010d7671e05f5@syzkaller.appspotmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
132 lines
3.8 KiB
C
132 lines
3.8 KiB
C
/*
|
|
* Copyright (c) 2005 Voltaire Inc. All rights reserved.
|
|
* Copyright (c) 2002-2005, Network Appliance, Inc. All rights reserved.
|
|
* Copyright (c) 1999-2005, Mellanox Technologies, Inc. All rights reserved.
|
|
* Copyright (c) 2005-2006 Intel Corporation. All rights reserved.
|
|
*
|
|
* This software is available to you under a choice of one of two
|
|
* licenses. You may choose to be licensed under the terms of the GNU
|
|
* General Public License (GPL) Version 2, available from the file
|
|
* COPYING in the main directory of this source tree, or the
|
|
* OpenIB.org BSD license below:
|
|
*
|
|
* Redistribution and use in source and binary forms, with or
|
|
* without modification, are permitted provided that the following
|
|
* conditions are met:
|
|
*
|
|
* - Redistributions of source code must retain the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer.
|
|
*
|
|
* - Redistributions in binary form must reproduce the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer in the documentation and/or other materials
|
|
* provided with the distribution.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
*/
|
|
|
|
#ifndef _CMA_PRIV_H
|
|
#define _CMA_PRIV_H
|
|
|
|
enum rdma_cm_state {
|
|
RDMA_CM_IDLE,
|
|
RDMA_CM_ADDR_QUERY,
|
|
RDMA_CM_ADDR_RESOLVED,
|
|
RDMA_CM_ROUTE_QUERY,
|
|
RDMA_CM_ROUTE_RESOLVED,
|
|
RDMA_CM_CONNECT,
|
|
RDMA_CM_DISCONNECT,
|
|
RDMA_CM_ADDR_BOUND,
|
|
RDMA_CM_LISTEN,
|
|
RDMA_CM_DEVICE_REMOVAL,
|
|
RDMA_CM_DESTROYING
|
|
};
|
|
|
|
struct rdma_id_private {
|
|
struct rdma_cm_id id;
|
|
|
|
struct rdma_bind_list *bind_list;
|
|
struct hlist_node node;
|
|
struct list_head list; /* listen_any_list or cma_device.list */
|
|
struct list_head listen_list; /* per device listens */
|
|
struct cma_device *cma_dev;
|
|
struct list_head mc_list;
|
|
|
|
int internal_id;
|
|
enum rdma_cm_state state;
|
|
spinlock_t lock;
|
|
struct mutex qp_mutex;
|
|
|
|
struct completion comp;
|
|
refcount_t refcount;
|
|
struct mutex handler_mutex;
|
|
|
|
int backlog;
|
|
int timeout_ms;
|
|
struct ib_sa_query *query;
|
|
int query_id;
|
|
union {
|
|
struct ib_cm_id *ib;
|
|
struct iw_cm_id *iw;
|
|
} cm_id;
|
|
|
|
u32 seq_num;
|
|
u32 qkey;
|
|
u32 qp_num;
|
|
u32 options;
|
|
u8 srq;
|
|
u8 tos;
|
|
u8 tos_set:1;
|
|
u8 timeout_set:1;
|
|
u8 min_rnr_timer_set:1;
|
|
u8 reuseaddr;
|
|
u8 afonly;
|
|
u8 timeout;
|
|
u8 min_rnr_timer;
|
|
u8 used_resolve_ip;
|
|
enum ib_gid_type gid_type;
|
|
|
|
/*
|
|
* Internal to RDMA/core, don't use in the drivers
|
|
*/
|
|
struct rdma_restrack_entry res;
|
|
struct rdma_ucm_ece ece;
|
|
};
|
|
|
|
#if IS_ENABLED(CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS)
|
|
int cma_configfs_init(void);
|
|
void cma_configfs_exit(void);
|
|
#else
|
|
static inline int cma_configfs_init(void)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void cma_configfs_exit(void)
|
|
{
|
|
}
|
|
#endif
|
|
|
|
void cma_dev_get(struct cma_device *dev);
|
|
void cma_dev_put(struct cma_device *dev);
|
|
typedef bool (*cma_device_filter)(struct ib_device *, void *);
|
|
struct cma_device *cma_enum_devices_by_ibdev(cma_device_filter filter,
|
|
void *cookie);
|
|
int cma_get_default_gid_type(struct cma_device *dev, u32 port);
|
|
int cma_set_default_gid_type(struct cma_device *dev, u32 port,
|
|
enum ib_gid_type default_gid_type);
|
|
int cma_get_default_roce_tos(struct cma_device *dev, u32 port);
|
|
int cma_set_default_roce_tos(struct cma_device *dev, u32 port,
|
|
u8 default_roce_tos);
|
|
struct ib_device *cma_get_ib_dev(struct cma_device *dev);
|
|
|
|
#endif /* _CMA_PRIV_H */
|