From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A352EC43381 for ; Tue, 26 Mar 2019 06:43:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7301D2070B for ; Tue, 26 Mar 2019 06:43:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553582587; bh=lZmLUbu784og2lgEKXi8oJSsDN5/BsTg+fmpZ0d9N/c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=C6YJXk5mXyn7jlP2YvHJ1SyTOtG1ls+4coAt2WMj7G+jqL/5a6Th8ZcMGNGRJBr7F yjdnPk5BMFbiqEz5dksyL9TVxiJBcb3Lm+TyGfWaTcYO0ZxzoDANGsWUtTuOkuNsAO syco57r/F7acUSG4IiXfQfeNaFrYWO3b9Rm+pslk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732474AbfCZGiE (ORCPT ); Tue, 26 Mar 2019 02:38:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:52152 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732176AbfCZGiA (ORCPT ); Tue, 26 Mar 2019 02:38:00 -0400 Received: from localhost (unknown [104.132.152.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8AF172075E; Tue, 26 Mar 2019 06:37:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553582280; bh=lZmLUbu784og2lgEKXi8oJSsDN5/BsTg+fmpZ0d9N/c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mW4ph59o3NhddQEiYYrHMRuJurN4QAuR64+zPxx+LpL/TneX2K60zSnSF2ujLvuSa hPvjabiy414tgiygB1645QfxorlrZivaUsJgFAlFMYI/bFhFwIQNPT1dmpD1GN7Rkk W9tpgsN6W4mAZmoNeuQDWGCYeVBei0IY2ZmTOqgQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+f3ce716af730c8f96637@syzkaller.appspotmail.com, Myungho Jung , Parav Pandit , Jason Gunthorpe Subject: [PATCH 4.19 35/45] RDMA/cma: Rollback source IP address if failing to acquire device Date: Tue, 26 Mar 2019 15:30:18 +0900 Message-Id: <20190326042704.515851977@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190326042702.565683325@linuxfoundation.org> References: <20190326042702.565683325@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Myungho Jung commit 5fc01fb846bce8fa6d5f95e2625b8ce0f8e86810 upstream. If cma_acquire_dev_by_src_ip() returns error in addr_handler(), the device state changes back to RDMA_CM_ADDR_BOUND but the resolved source IP address is still left. After that, if rdma_destroy_id() is called after rdma_listen(), the device is freed without removed from listen_any_list in cma_cancel_operation(). Revert to the previous IP address if acquiring device fails. Reported-by: syzbot+f3ce716af730c8f96637@syzkaller.appspotmail.com Signed-off-by: Myungho Jung Reviewed-by: Parav Pandit Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/core/cma.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2854,13 +2854,22 @@ static void addr_handler(int status, str { struct rdma_id_private *id_priv = context; struct rdma_cm_event event = {}; + struct sockaddr *addr; + struct sockaddr_storage old_addr; mutex_lock(&id_priv->handler_mutex); if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_QUERY, RDMA_CM_ADDR_RESOLVED)) goto out; - memcpy(cma_src_addr(id_priv), src_addr, rdma_addr_size(src_addr)); + /* + * Store the previous src address, so that if we fail to acquire + * matching rdma device, old address can be restored back, which helps + * to cancel the cma listen operation correctly. + */ + addr = cma_src_addr(id_priv); + memcpy(&old_addr, addr, rdma_addr_size(addr)); + memcpy(addr, src_addr, rdma_addr_size(src_addr)); if (!status && !id_priv->cma_dev) { status = cma_acquire_dev(id_priv, NULL); if (status) @@ -2871,6 +2880,8 @@ static void addr_handler(int status, str } if (status) { + memcpy(addr, &old_addr, + rdma_addr_size((struct sockaddr *)&old_addr)); if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_RESOLVED, RDMA_CM_ADDR_BOUND)) goto out;