linux/net/rds
Mahmoud Adam 62fc3357e0 net/rds: fix possible cp null dereference
cp might be null, calling cp->cp_conn would produce null dereference

[Simon Horman adds:]

Analysis:

* cp is a parameter of __rds_rdma_map and is not reassigned.

* The following call-sites pass a NULL cp argument to __rds_rdma_map()

  - rds_get_mr()
  - rds_get_mr_for_dest

* Prior to the code above, the following assumes that cp may be NULL
  (which is indicative, but could itself be unnecessary)

	trans_private = rs->rs_transport->get_mr(
		sg, nents, rs, &mr->r_key, cp ? cp->cp_conn : NULL,
		args->vec.addr, args->vec.bytes,
		need_odp ? ODP_ZEROBASED : ODP_NOT_NEEDED);

* The code modified by this patch is guarded by IS_ERR(trans_private),
  where trans_private is assigned as per the previous point in this analysis.

  The only implementation of get_mr that I could locate is rds_ib_get_mr()
  which can return an ERR_PTR if the conn (4th) argument is NULL.

* ret is set to PTR_ERR(trans_private).
  rds_ib_get_mr can return ERR_PTR(-ENODEV) if the conn (4th) argument is NULL.
  Thus ret may be -ENODEV in which case the code in question will execute.

Conclusion:
* cp may be NULL at the point where this patch adds a check;
  this patch does seem to address a possible bug

Fixes: c055fc00c0 ("net/rds: fix WARNING in rds_conn_connect_if_down")
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Mahmoud Adam <mngyadam@amazon.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240326153132.55580-1-mngyadam@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-03-29 12:04:09 -07:00
..
af_rds.c net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv 2024-01-22 11:24:00 +00:00
bind.c treewide: use get_random_{u8,u16}() when possible, part 2 2022-10-11 17:42:58 -06:00
cong.c net: rds: delete duplicated words 2020-09-18 14:12:43 -07:00
connection.c net: rds: Simplify the allocation of slab caches in rds_conn_init 2024-01-30 17:08:19 -08:00
ib_cm.c rds: ib: Remove two ib_modify_qp() calls 2021-04-12 19:51:48 -03:00
ib_frmr.c net/rds: dma_map_sg is entitled to merge entries 2021-08-18 15:35:50 -07:00
ib_mr.h RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
ib_rdma.c RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
ib_recv.c net: add missing includes of linux/sched/clock.h 2023-01-27 11:19:46 +00:00
ib_ring.c rds: Fix spelling mistakes 2021-05-31 22:45:05 -07:00
ib_send.c rds: Remove redundant assignment to nr_sig 2021-04-27 14:14:33 -07:00
ib_stats.c net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names' 2019-09-15 20:56:19 +02:00
ib_sysctl.c
ib.c RDMA: Split kernel-only global device caps from uverbs device caps 2022-04-06 15:02:13 -03:00
ib.h rds: stop using dmapool 2020-11-17 15:22:06 -04:00
info.c rds: fix crash in rds_info_getsockopt() 2020-05-20 14:08:06 -07:00
info.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
loop.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
loop.h rds: clean up loopback rds_connections on netns deletion 2018-06-27 10:11:03 +09:00
Makefile RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
message.c rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-02-13 09:33:39 +00:00
page.c rds: remove dead code 2016-12-26 21:35:39 -05:00
rdma_transport.c net: rds: Fix possible NULL-pointer dereference 2023-09-20 08:49:03 +01:00
rdma_transport.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
rdma.c net/rds: fix possible cp null dereference 2024-03-29 12:04:09 -07:00
rds_single_path.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rds.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
recv.c net:rds: Fix possible deadlock in rds_message_put 2024-02-13 10:25:30 +01:00
send.c rds: introduce acquire/release ordering in acquire/release_in_xmit() 2024-03-19 12:15:35 +01:00
stats.c rds: check for excessive looping in rds_send_xmit 2019-08-15 12:04:24 -07:00
sysctl.c
tcp_connect.c net: prevent address rewrite in kernel_bind() 2023-10-01 19:31:29 +01:00
tcp_listen.c ipv6: annotate data-races around np->mcast_oif 2023-12-11 10:59:17 +00:00
tcp_recv.c net/sock: Introduce trace_sk_data_ready() 2023-01-23 11:26:50 +00:00
tcp_send.c rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage 2023-06-24 15:50:12 -07:00
tcp_stats.c
tcp.c networking: Update to register_net_sysctl_sz 2023-08-15 15:26:18 -07:00
tcp.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
threads.c rds: Fix fall-through warnings for Clang 2021-05-17 20:00:27 -05:00
transport.c rds: transport module should be auto loaded when transport is set 2020-06-25 16:26:25 -07:00