From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, syzkaller <syzkaller@googlegroups.com>,
Noa Osherovich <noaos@mellanox.com>,
Leon Romanovsky <leonro@mellanox.com>,
Jason Gunthorpe <jgg@mellanox.com>
Subject: [PATCH 4.15 21/64] RDMA/uverbs: Sanitize user entered port numbers prior to access it
Date: Mon, 26 Feb 2018 21:21:58 +0100 [thread overview]
Message-ID: <20180226202154.355981720@linuxfoundation.org> (raw)
In-Reply-To: <20180226202153.453363333@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 5d4c05c3ee36f67ddc107ab5ea0898af01a62cc1 upstream.
==================================================================
BUG: KASAN: use-after-free in copy_ah_attr_from_uverbs+0x6f2/0x8c0
Read of size 4 at addr ffff88006476a198 by task syzkaller697701/265
CPU: 0 PID: 265 Comm: syzkaller697701 Not tainted 4.15.0+ #90
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Call Trace:
dump_stack+0xde/0x164
? dma_virt_map_sg+0x22c/0x22c
? show_regs_print_info+0x17/0x17
? lock_contended+0x11a0/0x11a0
print_address_description+0x83/0x3e0
kasan_report+0x18c/0x4b0
? copy_ah_attr_from_uverbs+0x6f2/0x8c0
? copy_ah_attr_from_uverbs+0x6f2/0x8c0
? lookup_get_idr_uobject+0x120/0x200
? copy_ah_attr_from_uverbs+0x6f2/0x8c0
copy_ah_attr_from_uverbs+0x6f2/0x8c0
? modify_qp+0xd0e/0x1350
modify_qp+0xd0e/0x1350
ib_uverbs_modify_qp+0xf9/0x170
? ib_uverbs_query_qp+0xa70/0xa70
ib_uverbs_write+0x7f9/0xef0
? attach_entity_load_avg+0x8b0/0x8b0
? ib_uverbs_query_qp+0xa70/0xa70
? uverbs_devnode+0x110/0x110
? cyc2ns_read_end+0x10/0x10
? print_irqtrace_events+0x280/0x280
? sched_clock_cpu+0x18/0x200
? _raw_spin_unlock_irq+0x29/0x40
? _raw_spin_unlock_irq+0x29/0x40
? _raw_spin_unlock_irq+0x29/0x40
? time_hardirqs_on+0x27/0x670
__vfs_write+0x10d/0x700
? uverbs_devnode+0x110/0x110
? kernel_read+0x170/0x170
? _raw_spin_unlock_irq+0x29/0x40
? finish_task_switch+0x1bd/0x7a0
? finish_task_switch+0x194/0x7a0
? prandom_u32_state+0xe/0x180
? rcu_read_unlock+0x80/0x80
? security_file_permission+0x93/0x260
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
? SyS_read+0x1a0/0x1a0
? trace_hardirqs_on_thunk+0x1a/0x1c
entry_SYSCALL_64_fastpath+0x1e/0x8b
RIP: 0033:0x433c29
RSP: 002b:00007ffcf2be82a8 EFLAGS: 00000217
Allocated by task 62:
kasan_kmalloc+0xa0/0xd0
kmem_cache_alloc+0x141/0x480
dup_fd+0x101/0xcc0
copy_process.part.62+0x166f/0x4390
_do_fork+0x1cb/0xe90
kernel_thread+0x34/0x40
call_usermodehelper_exec_work+0x112/0x260
process_one_work+0x929/0x1aa0
worker_thread+0x5c6/0x12a0
kthread+0x346/0x510
ret_from_fork+0x3a/0x50
Freed by task 259:
kasan_slab_free+0x71/0xc0
kmem_cache_free+0xf3/0x4c0
put_files_struct+0x225/0x2c0
exit_files+0x88/0xc0
do_exit+0x67c/0x1520
do_group_exit+0xe8/0x380
SyS_exit_group+0x1e/0x20
entry_SYSCALL_64_fastpath+0x1e/0x8b
The buggy address belongs to the object at ffff88006476a000
which belongs to the cache files_cache of size 832
The buggy address is located 408 bytes inside of
832-byte region [ffff88006476a000, ffff88006476a340)
The buggy address belongs to the page:
page:ffffea000191da80 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000008100(slab|head)
raw: 4000000000008100 0000000000000000 0000000000000000 0000000100080008
raw: 0000000000000000 0000000100000001 ffff88006bcf7a80 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88006476a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88006476a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88006476a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88006476a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88006476a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # 4.11
Fixes: 44c58487d51a ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/uverbs_cmd.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1970,8 +1970,15 @@ static int modify_qp(struct ib_uverbs_fi
goto release_qp;
}
+ if ((cmd->base.attr_mask & IB_QP_AV) &&
+ !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
+ ret = -EINVAL;
+ goto release_qp;
+ }
+
if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
- !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+ (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) ||
+ !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) {
ret = -EINVAL;
goto release_qp;
}
next prev parent reply other threads:[~2018-02-26 20:21 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-26 20:21 [PATCH 4.15 00/64] 4.15.7-stable review Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 01/64] netfilter: drop outermost socket lock in getsockopt() Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 02/64] arm64: mm: dont write garbage into TTBR1_EL1 register Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 03/64] kconfig.h: Include compiler types to avoid missed struct attributes Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 04/64] MIPS: boot: Define __ASSEMBLY__ for its.S build Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 05/64] xtensa: fix high memory/reserved memory collision Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 06/64] scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 07/64] MIPS: Drop spurious __unused in struct compat_flock Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 08/64] cfg80211: fix cfg80211_beacon_dup Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 09/64] i2c: designware: must wait for enable Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 10/64] i2c: bcm2835: Set up the rising/falling edge delays Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 11/64] X.509: fix BUG_ON() when hash algorithm is unsupported Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 12/64] X.509: fix NULL dereference when restricting key with unsupported_sig Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 13/64] PKCS#7: fix certificate chain verification Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 14/64] PKCS#7: fix certificate blacklisting Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 15/64] extcon: int3496: process id-pin first so that we start with the right status Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 16/64] genirq/matrix: Handle CPU offlining proper Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 17/64] RDMA/uverbs: Protect from races between lookup and destroy of uobjects Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 18/64] RDMA/uverbs: Protect from command mask overflow Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 19/64] RDMA/uverbs: Fix bad unlock balance in ib_uverbs_close_xrcd Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 20/64] RDMA/uverbs: Fix circular locking dependency Greg Kroah-Hartman
2018-02-26 20:21 ` Greg Kroah-Hartman [this message]
2018-02-26 20:21 ` [PATCH 4.15 22/64] iio: adc: stm32: fix stm32h7_adc_enable error handling Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 23/64] iio: srf08: fix link error "devm_iio_triggered_buffer_setup" undefined Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 24/64] iio: buffer: check if a buffer has been set up when poll is called Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 25/64] iio: adis_lib: Initialize trigger before requesting interrupt Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 26/64] Kbuild: always define endianess in kconfig.h Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 27/64] x86/apic/vector: Handle vector release on CPU unplug correctly Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 28/64] x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 29/64] mm, swap, frontswap: fix THP swap if frontswap enabled Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 30/64] mm: dont defer struct page initialization for Xen pv guests Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 31/64] uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 32/64] irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 33/64] irqchip/mips-gic: Avoid spuriously handling masked interrupts Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 34/64] PCI/cxgb4: Extend T3 PCI quirk to T4+ devices Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 35/64] net: thunderbolt: Tear down connection properly on suspend Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 36/64] net: thunderbolt: Run disconnect flow asynchronously when logout is received Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 37/64] ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 38/64] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 39/64] arm64: Remove unimplemented syscall log message Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 40/64] arm64: Disable unhandled signal log messages by default Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 41/64] arm64: cpufeature: Fix CTR_EL0 field definitions Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 42/64] Add delay-init quirk for Corsair K70 RGB keyboards Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 43/64] drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 44/64] usb: host: ehci: use correct device pointer for dma ops Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 45/64] usb: dwc3: gadget: Set maxpacket size for ep0 IN Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 46/64] usb: dwc3: ep0: Reset TRB counter " Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 47/64] usb: phy: mxs: Fix NULL pointer dereference on i.MX23/28 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 48/64] usb: ldusb: add PIDs for new CASSY devices supported by this driver Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 49/64] Revert "usb: musb: host: dont start next rx urb if current one failed" Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 50/64] usb: gadget: f_fs: Process all descriptors during bind Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 51/64] usb: gadget: f_fs: Use config_ep_by_speed() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 52/64] usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 53/64] drm/cirrus: Load lut in crtc_commit Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 54/64] drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 55/64] drm: Handle unexpected holes in color-eviction Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 56/64] drm/amdgpu: disable MMHUB power gating on raven Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 57/64] drm/amdgpu: fix VA hole handling on Vega10 v3 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 58/64] drm/amdgpu: Add dpm quirk for Jet PRO (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 59/64] drm/amdgpu: only check mmBIF_IOV_FUNC_IDENTIFIER on tonga/fiji Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 60/64] drm/amdgpu: add atpx quirk handling (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 61/64] drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 62/64] drm/amdgpu: add new device to use atpx quirk Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 63/64] arm64: __show_regs: Only resolve kernel symbols when running at EL1 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 64/64] drm/i915/breadcrumbs: Ignore unsubmitted signalers Greg Kroah-Hartman
2018-02-27 0:58 ` [PATCH 4.15 00/64] 4.15.7-stable review Shuah Khan
2018-02-27 13:09 ` Greg Kroah-Hartman
2018-02-27 7:07 ` Naresh Kamboju
2018-02-27 13:09 ` Greg Kroah-Hartman
2018-02-27 7:18 ` kernelci.org bot
2018-02-27 14:58 ` Guenter Roeck
2018-02-27 18:37 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180226202154.355981720@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=noaos@mellanox.com \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).