Piotr Stankiewicz 36d842194a IB/hfi1: Fix an out-of-bounds access in get_hw_stats ... When running with KASAN, the following trace is produced: [ 62.535888] ================================================================== [ 62.544930] BUG: KASAN: slab-out-of-bounds in gut_hw_stats+0x122/0x230 [hfi1] [ 62.553856] Write of size 8 at addr ffff88080e8d6330 by task kworker/0:1/14 [ 62.565333] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.0-test-build-kasan+ #8 [ 62.575087] Hardware name: Intel Corporation S2600KPR/S2600KPR, BIOS SE5C610.86B.01.01.0019.101220160604 10/12/2016 [ 62.587951] Workqueue: events work_for_cpu_fn [ 62.594050] Call Trace: [ 62.598023] dump_stack+0xc6/0x14c [ 62.603089] ? dump_stack_print_info.cold.1+0x2f/0x2f [ 62.610041] ? kmsg_dump_rewind_nolock+0x59/0x59 [ 62.616615] ? get_hw_stats+0x122/0x230 [hfi1] [ 62.622985] print_address_description+0x6c/0x23c [ 62.629744] ? get_hw_stats+0x122/0x230 [hfi1] [ 62.636108] kasan_report.cold.6+0x241/0x308 [ 62.642365] get_hw_stats+0x122/0x230 [hfi1] [ 62.648703] ? hfi1_alloc_rn+0x40/0x40 [hfi1] [ 62.655088] ? __kmalloc+0x110/0x240 [ 62.660695] ? hfi1_alloc_rn+0x40/0x40 [hfi1] [ 62.667142] setup_hw_stats+0xd8/0x430 [ib_core] [ 62.673972] ? show_hfi+0x50/0x50 [hfi1] [ 62.680026] ib_device_register_sysfs+0x165/0x180 [ib_core] [ 62.687995] ib_register_device+0x5a2/0xa10 [ib_core] [ 62.695340] ? show_hfi+0x50/0x50 [hfi1] [ 62.701421] ? ib_unregister_device+0x2e0/0x2e0 [ib_core] [ 62.709222] ? __vmalloc_node_range+0x2d0/0x380 [ 62.716131] ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt] [ 62.723735] ? vmalloc_node+0x5c/0x70 [ 62.729697] ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt] [ 62.737347] ? rvt_driver_mr_init+0x1f5/0x2d0 [rdmavt] [ 62.744998] ? __rvt_alloc_mr+0x110/0x110 [rdmavt] [ 62.752315] ? rvt_rc_error+0x140/0x140 [rdmavt] [ 62.759434] ? rvt_vma_open+0x30/0x30 [rdmavt] [ 62.766364] ? mutex_unlock+0x1d/0x40 [ 62.772445] ? kmem_cache_create_usercopy+0x15d/0x230 [ 62.780115] rvt_register_device+0x1f6/0x360 [rdmavt] [ 62.787823] ? rvt_get_port_immutable+0x180/0x180 [rdmavt] [ 62.796058] ? __get_txreq+0x400/0x400 [hfi1] [ 62.802969] ? memcpy+0x34/0x50 [ 62.808611] hfi1_register_ib_device+0xde6/0xeb0 [hfi1] [ 62.816601] ? hfi1_get_npkeys+0x10/0x10 [hfi1] [ 62.823760] ? hfi1_init+0x89f/0x9a0 [hfi1] [ 62.830469] ? hfi1_setup_eagerbufs+0xad0/0xad0 [hfi1] [ 62.838204] ? pcie_capability_clear_and_set_word+0xcd/0xe0 [ 62.846429] ? pcie_capability_read_word+0xd0/0xd0 [ 62.853791] ? hfi1_pcie_init+0x187/0x4b0 [hfi1] [ 62.860958] init_one+0x67f/0xae0 [hfi1] [ 62.867301] ? hfi1_init+0x9a0/0x9a0 [hfi1] [ 62.873876] ? wait_woken+0x130/0x130 [ 62.879860] ? read_word_at_a_time+0xe/0x20 [ 62.886329] ? strscpy+0x14b/0x280 [ 62.891998] ? hfi1_init+0x9a0/0x9a0 [hfi1] [ 62.898405] local_pci_probe+0x70/0xd0 [ 62.904295] ? pci_device_shutdown+0x90/0x90 [ 62.910833] work_for_cpu_fn+0x29/0x40 [ 62.916750] process_one_work+0x584/0x960 [ 62.922974] ? rcu_work_rcufn+0x40/0x40 [ 62.928991] ? __schedule+0x396/0xdc0 [ 62.934806] ? __sched_text_start+0x8/0x8 [ 62.941020] ? pick_next_task_fair+0x68b/0xc60 [ 62.947674] ? run_rebalance_domains+0x260/0x260 [ 62.954471] ? __list_add_valid+0x29/0xa0 [ 62.960607] ? move_linked_works+0x1c7/0x230 [ 62.967077] ? trace_event_raw_event_workqueue_execute_start+0x140/0x140 [ 62.976248] ? mutex_lock+0xa6/0x100 [ 62.982029] ? __mutex_lock_slowpath+0x10/0x10 [ 62.988795] ? __switch_to+0x37a/0x710 [ 62.994731] worker_thread+0x62e/0x9d0 [ 63.000602] ? max_active_store+0xf0/0xf0 [ 63.006828] ? __switch_to_asm+0x40/0x70 [ 63.012932] ? __switch_to_asm+0x34/0x70 [ 63.019013] ? __switch_to_asm+0x40/0x70 [ 63.025042] ? __switch_to_asm+0x34/0x70 [ 63.031030] ? __switch_to_asm+0x40/0x70 [ 63.037006] ? __schedule+0x396/0xdc0 [ 63.042660] ? kmem_cache_alloc_trace+0xf3/0x1f0 [ 63.049323] ? kthread+0x59/0x1d0 [ 63.054594] ? ret_from_fork+0x35/0x40 [ 63.060257] ? __sched_text_start+0x8/0x8 [ 63.066212] ? schedule+0xcf/0x250 [ 63.071529] ? __wake_up_common+0x110/0x350 [ 63.077794] ? __schedule+0xdc0/0xdc0 [ 63.083348] ? wait_woken+0x130/0x130 [ 63.088963] ? finish_task_switch+0x1f1/0x520 [ 63.095258] ? kasan_unpoison_shadow+0x30/0x40 [ 63.101792] ? __init_waitqueue_head+0xa0/0xd0 [ 63.108183] ? replenish_dl_entity.cold.60+0x18/0x18 [ 63.115151] ? _raw_spin_lock_irqsave+0x25/0x50 [ 63.121754] ? max_active_store+0xf0/0xf0 [ 63.127753] kthread+0x1ae/0x1d0 [ 63.132894] ? kthread_bind+0x30/0x30 [ 63.138422] ret_from_fork+0x35/0x40 [ 63.146973] Allocated by task 14: [ 63.152077] kasan_kmalloc+0xbf/0xe0 [ 63.157471] __kmalloc+0x110/0x240 [ 63.162804] init_cntrs+0x34d/0xdf0 [hfi1] [ 63.168883] hfi1_init_dd+0x29a3/0x2f90 [hfi1] [ 63.175244] init_one+0x551/0xae0 [hfi1] [ 63.181065] local_pci_probe+0x70/0xd0 [ 63.186759] work_for_cpu_fn+0x29/0x40 [ 63.192310] process_one_work+0x584/0x960 [ 63.198163] worker_thread+0x62e/0x9d0 [ 63.203843] kthread+0x1ae/0x1d0 [ 63.208874] ret_from_fork+0x35/0x40 [ 63.217203] Freed by task 1: [ 63.221844] __kasan_slab_free+0x12e/0x180 [ 63.227844] kfree+0x92/0x1a0 [ 63.232570] single_release+0x3a/0x60 [ 63.238024] __fput+0x1d9/0x480 [ 63.242911] task_work_run+0x139/0x190 [ 63.248440] exit_to_usermode_loop+0x191/0x1a0 [ 63.254814] do_syscall_64+0x301/0x330 [ 63.260283] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.270199] The buggy address belongs to the object at ffff88080e8d5500 which belongs to the cache kmalloc-4096 of size 4096 [ 63.287247] The buggy address is located 3632 bytes inside of 4096-byte region [ffff88080e8d5500, ffff88080e8d6500) [ 63.303564] The buggy address belongs to the page: [ 63.310447] page:ffffea00203a3400 count:1 mapcount:0 mapping:ffff88081380e840 index:0x0 compound_mapcount: 0 [ 63.323102] flags: 0x2fffff80008100(slab|head) [ 63.329775] raw: 002fffff80008100 0000000000000000 0000000100000001 ffff88081380e840 [ 63.340175] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 63.350564] page dumped because: kasan: bad access detected [ 63.361974] Memory state around the buggy address: [ 63.369137] ffff88080e8d6200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.379082] ffff88080e8d6280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.389032] >ffff88080e8d6300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 63.398944] ^ [ 63.406141] ffff88080e8d6380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.416109] ffff88080e8d6400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.426099] ================================================================== The trace happens because get_hw_stats() assumes there is room in the memory allocated in init_cntrs() to accommodate the driver counters. Unfortunately, that routine only allocated space for the device counters. Fix by insuring the allocation has room for the additional driver counters. Cc: <Stable@vger.kernel.org> # v4.14+ Fixes: b7481944b0 ("IB/hfi1: Show statistics counters under IB stats interface") Reviewed-by: Mike Marciniczyn <mike.marciniszyn@intel.com> Reviewed-by: Mike Ruhl <michael.j.ruhl@intel.com> Signed-off-by: Piotr Stankiewicz <piotr.stankiewicz@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>		2018-12-03 16:05:19 -05:00
..
accessibility
acpi	pwm: Changes for v4.20-rc1	2018-11-02 11:22:45 -07:00
amba
android
ata	libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9	2018-10-26 08:21:04 -06:00
atm	atm: zatm: Fix empty body Clang warnings	2018-10-18 15:39:10 -07:00
auxdisplay	The Compiler Attributes series	2018-11-01 18:34:46 -07:00
base	mm/memory_hotplug: fix online/offline_pages called w.o. mem_hotplug_lock	2018-10-31 08:54:17 -07:00
bcma
block	for-linus-20181102	2018-11-02 11:25:48 -07:00
bluetooth	Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-10-24 14:43:41 +01:00
bus	ARM: SoC driver updates for 4.17	2018-10-29 15:16:01 -07:00
cdrom	gdrom: fix mistake in assignment of error	2018-10-25 11:17:40 -06:00
char	RTC for 4.20	2018-10-27 09:24:24 -07:00
clk	This time it looks like a quieter release cycle in the clk tree. I guess that's	2018-10-31 11:08:30 -07:00
clocksource	Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-11-04 08:15:15 -08:00
connector
cpufreq	cpufreq: remove unused arm_big_little_dt driver	2018-10-25 18:39:02 +02:00
cpuidle	More power management updates for 4.20-rc1	2018-10-30 09:08:07 -07:00
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2018-10-25 16:43:35 -07:00
dax
dca
devfreq
dio
dma	pci-v4.20-changes	2018-10-25 06:50:48 -07:00
dma-buf
edac	* skx_edac: Address translation for NVDIMMs (Tony Luck and Qiuxu Zhuo)	2018-11-02 11:17:22 -07:00
eisa
extcon
firewire
firmware	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-11-03 18:25:17 -07:00
fmc
fpga	fpga: add devm_fpga_region_create	2018-10-16 11:13:50 +02:00
fsi	iov_iter: Separate type from direction and use accessor functions	2018-10-24 00:41:07 +01:00
gnss
gpio	pci-v4.20-changes	2018-10-25 06:50:48 -07:00
gpu	drm, i915, amdgpu, bridge + core quirk	2018-11-02 10:58:20 -07:00
hid	platform-drivers-x86 for v4.20-1	2018-11-01 08:42:21 -07:00
hsi
hv	hv_balloon: Replace spin_is_locked() with lockdep	2018-10-15 20:54:17 +02:00
hwmon	Lots of small changes to the IPMI driver. Most of the changes	2018-10-23 09:42:05 +01:00
hwspinlock
hwtracing
i2c	i2c: Clear client->irq in i2c_device_remove	2018-10-31 23:33:34 +00:00
ide
idle	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-10-23 13:32:18 +01:00
iio	Staging/IIO patches for 4.20-rc1	2018-10-29 10:38:10 -07:00
infiniband	IB/hfi1: Fix an out-of-bounds access in get_hw_stats	2018-12-03 16:05:19 -05:00
input	Merge branch 'xarray' of git://git.infradead.org/users/willy/linux-dax	2018-10-28 11:35:40 -07:00
iommu	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
ipack
irqchip	irqchip/irq-mvebu-sei: Fix a NULL vs IS_ERR() bug in probe function	2018-11-01 12:38:48 +01:00
isdn	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
leds	leds: gpio: set led_dat->gpiod pointer for OF defined GPIO leds	2018-10-26 20:51:36 +02:00
lightnvm
macintosh	memblock: stop using implicit alignment to SMP_CACHE_BYTES	2018-10-31 08:54:16 -07:00
mailbox	- Convert print users to use the %pOFn format specifier	2018-10-29 10:30:44 -07:00
mcb
md	for-linus-20181102	2018-11-02 11:25:48 -07:00
media	media updates for v4.20-rc1	2018-10-31 10:53:29 -07:00
memory
memstick
message
mfd	chrome-platform for v4.20	2018-10-31 16:47:55 -07:00
misc	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
mmc	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-10-23 13:32:18 +01:00
mtd	This pull request contains updates for UBIFS:	2018-11-04 14:46:04 -08:00
mux	This is the bulk of GPIO changes for the v4.20 series:	2018-10-23 08:45:05 +01:00
net	NTB IDT thermal changes and hook into hwmon, ntb_netdev clean-up of	2018-11-04 08:12:44 -08:00
nfc	NFC: nfcmrvl_uart: fix OF child-node lookup	2018-10-23 13:28:53 -05:00
ntb	ntb: idt: Alter the driver info comments	2018-11-01 10:33:12 -04:00
nubus
nvdimm	libnvdimm for 4.20	2018-10-25 06:31:56 -07:00
nvme	for-linus-20181102	2018-11-02 11:25:48 -07:00
nvmem	nvmem: hide unused nvmem_find_cell_by_index function	2018-10-15 15:56:15 +02:00
of	Devicetree fixes for v4.20-rc1:	2018-11-01 14:45:38 -07:00
opp
oprofile
parisc	parisc: Add alternative coding infrastructure	2018-10-17 17:22:26 +02:00
parport
pci	Merge branch 'xarray' of git://git.infradead.org/users/willy/linux-dax	2018-10-28 11:35:40 -07:00
pcmcia	powerpc updates for 4.20	2018-10-26 14:36:21 -07:00
perf	arm64 updates for 4.20:	2018-10-22 17:30:06 +01:00
phy	USB/PHY patches for 4.20-rc1	2018-10-26 08:14:13 -07:00
pinctrl	This is the bulk of GPIO changes for the v4.20 series:	2018-10-23 08:45:05 +01:00
platform	platform-drivers-x86 for v4.20-1	2018-11-01 08:42:21 -07:00
pnp
power	Devicetree updates for 4.20:	2018-10-26 12:09:58 -07:00
powercap	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-10-23 13:32:18 +01:00
pps
ps3
ptp	ptp: drop redundant kasprintf() to create worker name	2018-10-28 19:20:06 -07:00
pwm	pwm: lpss: Only set update bit if we are actually changing the settings	2018-10-16 13:16:15 +02:00
rapidio
ras
regulator	regulator: Regulator updates for next release	2018-10-23 01:54:44 +01:00
remoteproc	remoteproc: qcom: q6v5-mss: Register segments/dumpfn for coredump	2018-10-19 12:54:03 -07:00
reset	ARM: SoC driver updates for 4.17	2018-10-29 15:16:01 -07:00
rpmsg
rtc	rtc: sc27xx: Always read normal alarm when registering RTC device	2018-10-25 02:35:42 +02:00
s390	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
sbus
scsi	Kbuild updates for v4.20 (2nd)	2018-11-03 10:47:33 -07:00
sfi	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
sh
siox
slimbus
sn
soc	soc: ti: QMSS: Fix usage of irq_set_affinity_hint	2018-11-02 11:22:09 -07:00
soundwire
spi	- New Drivers	2018-10-25 06:19:15 -07:00
spmi
ssb
staging	media updates for v4.20-rc1	2018-10-31 10:53:29 -07:00
target	SCSI misc on 20181102	2018-11-03 10:34:03 -07:00
tc
tee
thermal	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2018-10-31 11:28:12 -07:00
thunderbolt
tty	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
uio
usb	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
uwb
vfio	VFIO updates for v4.20	2018-10-31 11:01:38 -07:00
vhost	virtio, vhost: fixes, tweaks	2018-11-01 14:42:49 -07:00
video	fbdev changes for v4.20:	2018-10-31 11:41:37 -07:00
virt
virtio	virtio-balloon: VIRTIO_BALLOON_F_PAGE_POISON	2018-10-24 20:57:55 -04:00
visorbus
vlynq
vme
w1	w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size).	2018-10-15 20:50:32 +02:00
watchdog	watchdog: ts4800: release syscon device node in ts4800_wdt_probe()	2018-10-22 10:16:28 +02:00
xen	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
zorro
Kconfig
Makefile