From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+7b62c837c2516f8f38c8@syzkaller.appspotmail.com,
Leon Romanovsky <leonro@mellanox.com>,
Jason Gunthorpe <jgg@mellanox.com>
Subject: [PATCH 4.9 039/102] RDMA/ucma: Check that device is connected prior to access it
Date: Fri, 6 Apr 2018 15:23:20 +0200 [thread overview]
Message-ID: <20180406084337.178962058@linuxfoundation.org> (raw)
In-Reply-To: <20180406084331.507038179@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 4b658d1bbc16605330694bb3ef2570c465ef383d upstream.
Add missing check that device is connected prior to access it.
[ 55.358652] BUG: KASAN: null-ptr-deref in rdma_init_qp_attr+0x4a/0x2c0
[ 55.359389] Read of size 8 at addr 00000000000000b0 by task qp/618
[ 55.360255]
[ 55.360432] CPU: 1 PID: 618 Comm: qp Not tainted 4.16.0-rc1-00071-gcaf61b1b8b88 #91
[ 55.361693] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014
[ 55.363264] Call Trace:
[ 55.363833] dump_stack+0x5c/0x77
[ 55.364215] kasan_report+0x163/0x380
[ 55.364610] ? rdma_init_qp_attr+0x4a/0x2c0
[ 55.365238] rdma_init_qp_attr+0x4a/0x2c0
[ 55.366410] ucma_init_qp_attr+0x111/0x200
[ 55.366846] ? ucma_notify+0xf0/0xf0
[ 55.367405] ? _get_random_bytes+0xea/0x1b0
[ 55.367846] ? urandom_read+0x2f0/0x2f0
[ 55.368436] ? kmem_cache_alloc_trace+0xd2/0x1e0
[ 55.369104] ? refcount_inc_not_zero+0x9/0x60
[ 55.369583] ? refcount_inc+0x5/0x30
[ 55.370155] ? rdma_create_id+0x215/0x240
[ 55.370937] ? _copy_to_user+0x4f/0x60
[ 55.371620] ? mem_cgroup_commit_charge+0x1f5/0x290
[ 55.372127] ? _copy_from_user+0x5e/0x90
[ 55.372720] ucma_write+0x174/0x1f0
[ 55.373090] ? ucma_close_id+0x40/0x40
[ 55.373805] ? __lru_cache_add+0xa8/0xd0
[ 55.374403] __vfs_write+0xc4/0x350
[ 55.374774] ? kernel_read+0xa0/0xa0
[ 55.375173] ? fsnotify+0x899/0x8f0
[ 55.375544] ? fsnotify_unmount_inodes+0x170/0x170
[ 55.376689] ? __fsnotify_update_child_dentry_flags+0x30/0x30
[ 55.377522] ? handle_mm_fault+0x174/0x320
[ 55.378169] vfs_write+0xf7/0x280
[ 55.378864] SyS_write+0xa1/0x120
[ 55.379270] ? SyS_read+0x120/0x120
[ 55.379643] ? mm_fault_error+0x180/0x180
[ 55.380071] ? task_work_run+0x7d/0xd0
[ 55.380910] ? __task_pid_nr_ns+0x120/0x140
[ 55.381366] ? SyS_read+0x120/0x120
[ 55.381739] do_syscall_64+0xeb/0x250
[ 55.382143] entry_SYSCALL_64_after_hwframe+0x21/0x86
[ 55.382841] RIP: 0033:0x7fc2ef803e99
[ 55.383227] RSP: 002b:00007fffcc5f3be8 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
[ 55.384173] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc2ef803e99
[ 55.386145] RDX: 0000000000000057 RSI: 0000000020000080 RDI: 0000000000000003
[ 55.388418] RBP: 00007fffcc5f3c00 R08: 0000000000000000 R09: 0000000000000000
[ 55.390542] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000400480
[ 55.392916] R13: 00007fffcc5f3cf0 R14: 0000000000000000 R15: 0000000000000000
[ 55.521088] Code: e5 4d 1e ff 48 89 df 44 0f b6 b3 b8 01 00 00 e8 65 50 1e ff 4c 8b 2b 49
8d bd b0 00 00 00 e8 56 50 1e ff 41 0f b6 c6 48 c1 e0 04 <49> 03 85 b0 00 00 00 48 8d 78 08
48 89 04 24 e8 3a 4f 1e ff 48
[ 55.525980] RIP: rdma_init_qp_attr+0x52/0x2c0 RSP: ffff8801e2c2f9d8
[ 55.532648] CR2: 00000000000000b0
[ 55.534396] ---[ end trace 70cee64090251c0b ]---
Fixes: 75216638572f ("RDMA/cma: Export rdma cm interface to userspace")
Fixes: d541e45500bd ("IB/core: Convert ah_attr from OPA to IB when copying to user")
Reported-by: <syzbot+7b62c837c2516f8f38c8@syzkaller.appspotmail.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ucma.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1156,6 +1156,11 @@ static ssize_t ucma_init_qp_attr(struct
if (IS_ERR(ctx))
return PTR_ERR(ctx);
+ if (!ctx->cm_id->device) {
+ ret = -EINVAL;
+ goto out;
+ }
+
resp.qp_attr_mask = 0;
memset(&qp_attr, 0, sizeof qp_attr);
qp_attr.qp_state = cmd.qp_state;
next prev parent reply other threads:[~2018-04-06 13:23 UTC|newest]
Thread overview: 111+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-06 13:22 [PATCH 4.9 000/102] 4.9.93-stable review Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 001/102] ARM: 8746/1: vfp: Go back to clearing vfp_current_hw_state[] Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 002/102] mtd: jedec_probe: Fix crash in jedec_read_mfr() Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 003/102] ALSA: usb-audio: Add native DSD support for TEAC UD-301 Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 004/102] ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 005/102] ALSA: pcm: potential uninitialized return values Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 006/102] perf/hwbp: Simplify the perf-hwbp code, fix documentation Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 007/102] ceph: only dirty ITER_IOVEC pages for direct read Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 008/102] ipc/shm.c: add split function to shm_vm_ops Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 009/102] powerpc/64s: Fix lost pending interrupt due to race causing lost update to irq_happened Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 010/102] powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 011/102] partitions/msdos: Unable to mount UFS 44bsd partitions Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 012/102] kprobes/x86: Fix to set RWX bits correctly before releasing trampoline Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 013/102] PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 014/102] dm ioctl: remove double parentheses Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 015/102] Input: mousedev - fix implicit conversion warning Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 016/102] netfilter: nf_nat_h323: fix logical-not-parentheses warning Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 017/102] genirq: Use cpumask_available() for check of cpumask variable Greg Kroah-Hartman
2018-04-06 13:22 ` [PATCH 4.9 018/102] cpumask: Add helper cpumask_available() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 019/102] selinux: Remove unnecessary check of array base in selinux_set_mapping() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 020/102] fs: compat: Remove warning from COMPATIBLE_IOCTL Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 021/102] jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 022/102] frv: declare jiffies to be located in the .data section Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 023/102] usb: gadget: remove redundant self assignment Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 024/102] xgene_enet: remove bogus forward declarations Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 025/102] nl80211: Fix enum type of variable in nl80211_put_sta_rate() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 026/102] cfg80211: Fix array-bounds warning in fragment copy Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 027/102] HID: sony: Use LED_CORE_SUSPENDRESUME Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 028/102] netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 029/102] mac80211: Fix clang warning about constant operand in logical operation Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 030/102] mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 031/102] btrfs: Remove extra parentheses from condition in copy_items() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 032/102] arm64: avoid overflow in VA_START and PAGE_OFFSET Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 033/102] selinux: Remove redundant check for unknown labeling behavior Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 034/102] mm/vmscan.c: fix unsequenced modification and access warning Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 035/102] xfrm_user: uncoditionally validate esn replay attribute struct Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 036/102] RDMA/ucma: Check AF family prior resolving address Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 037/102] RDMA/ucma: Fix use-after-free access in ucma_close Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 038/102] RDMA/ucma: Ensure that CM_ID exists prior to access it Greg Kroah-Hartman
2018-04-06 13:23 ` Greg Kroah-Hartman [this message]
2018-04-06 13:23 ` [PATCH 4.9 040/102] RDMA/ucma: Check that device exists prior to accessing it Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 041/102] RDMA/ucma: Introduce safer rdma_addr_size() variants Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 042/102] net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 043/102] xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 044/102] netfilter: bridge: ebt_among: add more missing match size checks Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 045/102] netfilter: x_tables: add and use xt_check_proc_name Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 046/102] Bluetooth: Fix missing encryption refresh on Security Request Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 047/102] llist: clang: introduce member_address_is_nonnull() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 048/102] scsi: virtio_scsi: always read VPD pages for multiqueue too Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 049/102] usb: dwc2: Improve gadget state disconnection handling Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 050/102] arm64: mm: Use non-global mappings for kernel space Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 051/102] arm64: mm: Move ASID from TTBR0 to TTBR1 Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 052/102] arm64: mm: Allocate ASIDs in pairs Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 053/102] arm64: mm: Add arm64_kernel_unmapped_at_el0 helper Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 054/102] arm64: mm: Invalidate both kernel and user ASIDs when performing TLBI Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 055/102] arm64: factor out entry stack manipulation Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 056/102] module: extend rodata=off boot cmdline parameter to module mappings Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 057/102] arm64: entry: Add exception trampoline page for exceptions from EL0 Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 058/102] arm64: mm: Map entry trampoline into trampoline and kernel page tables Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 059/102] arm64: entry: Explicitly pass exception level to kernel_ventry macro Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 060/102] arm64: entry: Hook up entry trampoline to exception vectors Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 061/102] arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 062/102] arm64: entry: Add fake CPU feature for unmapping the kernel at EL0 Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 063/102] arm64: kaslr: Put kernel vectors address in separate data page Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 064/102] arm64: use RET instruction for exiting the trampoline Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 065/102] arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0 Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 066/102] arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 067/102] arm64: Take into account ID_AA64PFR0_EL1.CSV3 Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 068/102] arm64: Allow checking of a CPU-local erratum Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 069/102] arm64: capabilities: Handle duplicate entries for a capability Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 070/102] arm64: cputype: Add MIDR values for Cavium ThunderX2 CPUs Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 071/102] arm64: Turn on KPTI only on CPUs that need it Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 072/102] arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0() Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 073/102] arm64: kpti: Add ->enable callback to remap swapper using nG mappings Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 074/102] arm64: Force KPTI to be disabled on Cavium ThunderX Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 075/102] arm64: entry: Reword comment about post_ttbr_update_workaround Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 076/102] arm64: idmap: Use "awx" flags for .idmap.text .pushsection directives Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 077/102] USB: serial: ftdi_sio: add RT Systems VX-8 cable Greg Kroah-Hartman
2018-04-06 13:23 ` [PATCH 4.9 078/102] USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 079/102] USB: serial: cp210x: add ELDAT Easywave RX09 id Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 080/102] mei: remove dev_err message on an unsupported ioctl Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 081/102] media: usbtv: prevent double free in error case Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 082/102] parport_pc: Add support for WCH CH382L PCI-E single parallel port card Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 083/102] crypto: ahash - Fix early termination in hash walk Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 084/102] crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 085/102] staging: comedi: ni_mio_common: ack ai fifo error interrupts Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 086/102] Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370 Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 087/102] Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 088/102] Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 089/102] vt: change SGR 21 to follow the standards Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 090/102] Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property definition Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 091/102] ARM: dts: dra7: Add power hold and power controller properties to palmas Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 092/102] ARM: dts: am57xx-beagle-x15-common: Add overide powerhold property Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 093/102] ARM: dts: am57xx-idk-common: " Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 094/102] md/raid10: reset the first at the end of loop Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 095/102] net: hns: Fix ethtool private flags Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 096/102] Fix slab name "biovec-(1<<(21-12))" Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 097/102] Revert "ARM: dts: am335x-pepper: Fix the audio CODECs reset pin" Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 098/102] Revert "ARM: dts: omap3-n900: " Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 099/102] Revert "spi: bcm-qspi: shut up warning about cfi header inclusion" Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 100/102] Revert "mtip32xx: use runtime tag to initialize command header" Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 101/102] Revert "ip6_vti: adjust vti mtu according to mtu of lower device" Greg Kroah-Hartman
2018-04-06 13:24 ` [PATCH 4.9 102/102] spi: davinci: fix up dma_mapping_error() incorrect patch Greg Kroah-Hartman
2018-04-06 17:22 ` [PATCH 4.9 000/102] 4.9.93-stable review kernelci.org bot
2018-04-06 22:14 ` Shuah Khan
2018-04-06 22:25 ` Dan Rue
2018-04-07 6:11 ` Greg Kroah-Hartman
2018-04-12 12:17 ` Thierry Escande
2018-04-12 12:23 ` Greg Kroah-Hartman
2018-04-12 12:32 ` Thierry Escande
2018-04-12 16:56 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180406084337.178962058@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+7b62c837c2516f8f38c8@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).