Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-29 06:12:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
4fae7f1704
linux/drivers/infiniband/core
History
Leon Romanovsky 4fae7f1704 RDMA/uverbs: Fix slab-out-of-bounds in ib_uverbs_ex_create_flow 
The check of cmd.flow_attr.size should check into account the size of the
reserved field (2 bytes), otherwise user can provide a size which will
cause a slab-out-of-bounds warning below.

==================================================================
BUG: KASAN: slab-out-of-bounds in ib_uverbs_ex_create_flow+0x1740/0x1d00
Read of size 2 at addr ffff880068dff1a6 by task syz-executor775/269

CPU: 0 PID: 269 Comm: syz-executor775 Not tainted 4.18.0-rc1+ #245
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014
Call Trace:
 dump_stack+0xef/0x17e
 print_address_description+0x83/0x3b0
 kasan_report+0x18d/0x4d0
 ib_uverbs_ex_create_flow+0x1740/0x1d00
 ib_uverbs_write+0x923/0x1010
 __vfs_write+0x10d/0x720
 vfs_write+0x1b0/0x550
 ksys_write+0xc6/0x1a0
 do_syscall_64+0xa7/0x590
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x433899
Code: fd ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89
f7 48 89 d6 48 89 ca 4d 89 c2 4d
89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b 91 fd ff c3 66
2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc2724db58 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000020006880 RCX: 0000000000433899
RDX: 00000000000000e0 RSI: 0000000020002480 RDI: 0000000000000003
RBP: 00000000006d7018 R08: 00000000004002f8 R09: 00000000004002f8
R10: 00000000004002f8 R11: 0000000000000217 R12: 0000000000000000

R13: 000000000040cd20 R14: 000000000040cdb0 R15: 0000000000000006

Allocated by task 269:
 kasan_kmalloc+0xa0/0xd0
 __kmalloc+0x1a9/0x510
 ib_uverbs_ex_create_flow+0x26c/0x1d00
 ib_uverbs_write+0x923/0x1010
 __vfs_write+0x10d/0x720
 vfs_write+0x1b0/0x550
 ksys_write+0xc6/0x1a0
 do_syscall_64+0xa7/0x590
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 0:
 __kasan_slab_free+0x12e/0x180
 kfree+0x159/0x630
 detach_buf+0x559/0x7a0
 virtqueue_get_buf_ctx+0x3cc/0xab0
 virtblk_done+0x1eb/0x3d0
 vring_interrupt+0x16d/0x2b0
 __handle_irq_event_percpu+0x10a/0x980
 handle_irq_event_percpu+0x77/0x190
 handle_irq_event+0xc6/0x1a0
 handle_edge_irq+0x211/0xd80
 handle_irq+0x3d/0x60
 do_IRQ+0x9b/0x220

The buggy address belongs to the object at ffff880068dff180
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 38 bytes inside of
 64-byte region [ffff880068dff180, ffff880068dff1c0)
The buggy address belongs to the page:
page:ffffea0001a37fc0 count:1 mapcount:0 mapping:ffff88006c401780
index:0x0
flags: 0x4000000000000100(slab)
raw: 4000000000000100 ffffea0001a31100 0000001100000011 ffff88006c401780
raw: 0000000000000000 00000000802a002a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff880068dff080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
 ffff880068dff100: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
>ffff880068dff180: 00 00 00 00 07 fc fc fc fc fc fc fc fb fb fb fb
                               ^
 ffff880068dff200: fb fb fb fb fc fc fc fc 00 00 00 00 00 00 fc fc
 ffff880068dff280: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc
==================================================================

Cc: <stable@vger.kernel.org> # 3.12
Fixes: f884827438 ("IB/core: clarify overflow/underflow checks on ib_create/destroy_flow")
Cc: syzkaller <syzkaller@googlegroups.com>
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-06-25 15:27:51 -06:00
..
addr.c RDMA/rdma_cm: Delete rdma_addr_client 2018-04-17 19:42:50 -06:00
agent.c IB/core: Rename ib_destroy_ah to rdma_destroy_ah 2017-05-01 14:32:43 -04:00
agent.h
cache.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
cgroup.c
cm_msgs.h
cm.c 4.18 Merge window pull request 2018-06-07 13:04:07 -07:00
cma_configfs.c IB/cma: use strlcpy() instead of strncpy() 2018-01-15 15:33:21 -07:00
cma_priv.h RDMA/cma: Move rdma_cm_state to cma_priv.h 2018-03-29 13:54:21 -06:00
cma.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
core_priv.h RDMA/core: Remove indirection through ib_cache_setup() 2018-05-29 15:19:31 -06:00
cq.c RDMA/core: Reduce poll batch for direct cq polling 2018-03-06 20:08:39 -07:00
device.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
fmr_pool.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
iwcm.c RDMA/netlink: Fix general protection fault 2017-12-07 15:28:07 -05:00
iwcm.h
iwpm_msg.c RDMA/iwpm: Properly mark end of NL messages 2017-09-29 11:32:42 -04:00
iwpm_util.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
iwpm_util.h
mad_priv.h
mad_rmpp.c IB/mad: Change slid in RMPP recv from 16 to 32 bits 2017-08-08 14:47:18 -04:00
mad_rmpp.h
mad.c RDMA/mad: Convert BUG_ONs to error flows 2018-06-01 11:16:24 -04:00
Makefile Verbs flow counters support 2018-06-04 08:48:11 -06:00
mr_pool.c
multicast.c treewide: Use struct_size() for kmalloc()-family 2018-06-06 11:15:43 -07:00
netlink.c RDMA/netlink: Simplify code of autoload modules 2018-01-02 13:36:57 -07:00
nldev.c RDMA/NLDEV: remove mr iova attribute 2018-05-15 16:17:38 -06:00
opa_smi.h
packer.c
rdma_core.c IB/uverbs: Tidy uverbs_uobject_add 2018-02-28 12:55:03 -07:00
rdma_core.h IB/core: Add new ioctl interface 2017-08-31 08:35:09 -04:00
restrack.c RDMA/restrack: Change SPDX tag to properly reflect license 2018-06-05 14:04:20 -06:00
roce_gid_mgmt.c IB/core: Remove duplicate declaration of gid_cache_wq 2018-05-24 09:39:25 -06:00
rw.c IB/core: remove redundant check on prot_sg_cnt 2017-10-10 10:49:45 -04:00
sa_query.c IB/cma: Resolve route only while receiving CM requests 2018-03-23 10:58:05 -06:00
sa.h
security.c IB/core: Use CONFIG_SECURITY_INFINIBAND to compile out security code 2018-05-01 11:16:36 -04:00
smi.c
smi.h
sysfs.c IB/core: Refactor GID modify code for RoCE 2018-04-03 21:33:50 -06:00
ucm.c RDMA: Use u64_to_user_ptr everywhere 2018-03-29 13:42:29 -06:00
ucma.c infiniband: fix a possible use-after-free bug 2018-06-04 09:37:03 -06:00
ud_header.c
umem_odp.c treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
umem.c Merge branch 'mr_fix' into git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma for-next 2018-05-28 11:44:35 -06:00
user_mad.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
uverbs_cmd.c RDMA/uverbs: Fix slab-out-of-bounds in ib_uverbs_ex_create_flow 2018-06-25 15:27:51 -06:00
uverbs_ioctl_merge.c treewide: Use struct_size() for kmalloc()-family 2018-06-06 11:15:43 -07:00
uverbs_ioctl.c IB/uverbs: Fix validating mandatory attributes 2018-04-27 13:53:41 -04:00
uverbs_main.c IB/uverbs: Fix ordering of ucontext check in ib_uverbs_write 2018-06-12 14:39:32 -06:00
uverbs_marshall.c IB/core: Convert OPA AH to IB for Extended LIDs only 2017-11-13 15:53:57 -05:00
uverbs_std_types_counters.c IB/uverbs: Add read counters support 2018-06-02 07:33:55 +03:00
uverbs_std_types_cq.c IB/uverbs: Add an ib_uobject getter to ioctl() infrastructure 2018-06-02 07:33:53 +03:00
uverbs_std_types_dm.c IB/uverbs: Add alloc/free dm uverbs ioctl support 2018-04-05 11:16:39 -06:00
uverbs_std_types_flow_action.c Verbs flow counters support 2018-06-04 08:48:11 -06:00
uverbs_std_types_mr.c IB/uverbs: Add device memory registration ioctl support 2018-04-05 11:16:39 -06:00
uverbs_std_types.c IB/uverbs: Add create/destroy counters support 2018-06-02 07:33:54 +03:00
uverbs.h IB/uverbs: Add support for flow counters 2018-06-02 07:33:56 +03:00
verbs.c RDMA/core: Save kernel caller name when creating CQ using ib_create_cq() 2018-06-18 11:32:58 -06:00