Linux-RDMA Archive on lore.kernel.org
 help / color / Atom feed
From: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
To: Jason Gunthorpe <jgg@nvidia.com>, Ira Weiny <ira.weiny@intel.com>
Cc: dledford@redhat.com, linux-rdma@vger.kernel.org,
	Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>,
	stable@vger.kernel.org
Subject: Re: [PATCH for-rc 4/4] IB/hfi1: Fix regressions in security fix
Date: Wed, 7 Apr 2021 16:20:48 -0400
Message-ID: <2dd3a09a-e0d7-8763-059c-3fcf4e04d1a7@cornelisnetworks.com> (raw)
In-Reply-To: <20210407183341.GA551308@nvidia.com>

On 4/7/2021 2:33 PM, Jason Gunthorpe wrote:
> On Mon, Mar 29, 2021 at 11:36:09AM -0700, Ira Weiny wrote:
>> On Mon, Mar 29, 2021 at 09:48:20AM -0400, dennis.dalessandro@cornelisnetworks.com wrote:
>>> From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
>>>
>>> The security code guards for non-current mm in all cases for
>>> updating the rb tree.
>>>
>>> That is ok for insert, but NOT ok for remove, since the insert
>>> has already guarded the node from being inserted and the remove
>>> can be called with a different mm because of a segfault other similar
>>> "close" issues where current-mm is NULL.
>>>
>>> Best case, is we leak pages. worst case we delete items for an lru_list
>>> more than once:
>>> [20945.911107] list_del corruption, ffffa0cd536bcac8->next is LIST_POISON1 (dead000000000100)
>>>
>>> Fix by removing the guard from any functions that remove nodes
>>> from the tree assuming the node was entered into the tree as valid since
>>> the insert is guarded.
>>
>> Does this open up a child process being able to remove nodes which the parent
>> added?
> 
> Dennis?

I believe it does in a way. I'm not sure what we can do about it.

One thought was to check mm for NULL and if so remove unconditionally 
because that means it's coming from the kernel killing the proc or 
something along those lines. If it's not NULL check against the saved mm 
value. Ira, do you recall discussing that during our internal review?

Need to do some more thinking on the right thing to do as I'm sure there 
are corner cases that I'm not seeing.

-Denny



  reply index

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-29 13:48 [PATCH for-rc 0/4] hfi fixes dennis.dalessandro
2021-03-29 13:48 ` [PATCH for-rc 1/4] IB/hfi1: Call xa_destroy before freeing dummy_netdev dennis.dalessandro
2021-03-29 14:09   ` Jason Gunthorpe
2021-03-31 19:36     ` Dennis Dalessandro
2021-04-01  6:06       ` Greg KH
2021-04-01 14:02         ` Dennis Dalessandro
2021-04-01 14:12           ` Greg KH
2021-04-01 15:00             ` Dennis Dalessandro
2021-04-01 12:33       ` Jason Gunthorpe
2021-04-01 13:42         ` Wan, Kaike
2021-04-01 13:48           ` Jason Gunthorpe
2021-03-29 13:48 ` [PATCH for-rc 2/4] IB/hfi1: Call xa_destroy before unloading the module dennis.dalessandro
2021-03-29 14:11   ` Jason Gunthorpe
2021-04-08 13:30     ` Dennis Dalessandro
2021-03-29 13:48 ` [PATCH for-rc 3/4] IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS dennis.dalessandro
2021-04-07 23:04   ` Jason Gunthorpe
2021-03-29 13:48 ` [PATCH for-rc 4/4] IB/hfi1: Fix regressions in security fix dennis.dalessandro
2021-03-29 18:36   ` Ira Weiny
2021-04-07 18:33     ` Jason Gunthorpe
2021-04-07 20:20       ` Dennis Dalessandro [this message]
2021-04-13 22:55   ` Jason Gunthorpe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2dd3a09a-e0d7-8763-059c-3fcf4e04d1a7@cornelisnetworks.com \
    --to=dennis.dalessandro@cornelisnetworks.com \
    --cc=dledford@redhat.com \
    --cc=ira.weiny@intel.com \
    --cc=jgg@nvidia.com \
    --cc=linux-rdma@vger.kernel.org \
    --cc=mike.marciniszyn@cornelisnetworks.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-RDMA Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-rdma/0 linux-rdma/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-rdma linux-rdma/ https://lore.kernel.org/linux-rdma \
		linux-rdma@vger.kernel.org
	public-inbox-index linux-rdma

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-rdma


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git