From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Selvin Xavier <selvin.xavier@broadcom.com>,
Doug Ledford <dledford@redhat.com>,
Sasha Levin <sashal@kernel.org>,
linux-rdma@vger.kernel.org
Subject: [PATCH AUTOSEL 5.2 73/76] RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message
Date: Thu, 29 Aug 2019 14:13:08 -0400 [thread overview]
Message-ID: <20190829181311.7562-73-sashal@kernel.org> (raw)
In-Reply-To: <20190829181311.7562-1-sashal@kernel.org>
From: Selvin Xavier <selvin.xavier@broadcom.com>
[ Upstream commit d37b1e534071ab1983e7c85273234b132c77591a ]
Driver copies FW commands to the HW queue as units of 16 bytes. Some
of the command structures are not exact multiple of 16. So while copying
the data from those structures, the stack out of bounds messages are
reported by KASAN. The following error is reported.
[ 1337.530155] ==================================================================
[ 1337.530277] BUG: KASAN: stack-out-of-bounds in bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
[ 1337.530413] Read of size 16 at addr ffff888725477a48 by task rmmod/2785
[ 1337.530540] CPU: 5 PID: 2785 Comm: rmmod Tainted: G OE 5.2.0-rc6+ #75
[ 1337.530541] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014
[ 1337.530542] Call Trace:
[ 1337.530548] dump_stack+0x5b/0x90
[ 1337.530556] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
[ 1337.530560] print_address_description+0x65/0x22e
[ 1337.530568] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
[ 1337.530575] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
[ 1337.530577] __kasan_report.cold.3+0x37/0x77
[ 1337.530581] ? _raw_write_trylock+0x10/0xe0
[ 1337.530588] ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
[ 1337.530590] kasan_report+0xe/0x20
[ 1337.530592] memcpy+0x1f/0x50
[ 1337.530600] bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
[ 1337.530608] ? bnxt_qplib_creq_irq+0xa0/0xa0 [bnxt_re]
[ 1337.530611] ? xas_create+0x3aa/0x5f0
[ 1337.530613] ? xas_start+0x77/0x110
[ 1337.530615] ? xas_clear_mark+0x34/0xd0
[ 1337.530623] bnxt_qplib_free_mrw+0x104/0x1a0 [bnxt_re]
[ 1337.530631] ? bnxt_qplib_destroy_ah+0x110/0x110 [bnxt_re]
[ 1337.530633] ? bit_wait_io_timeout+0xc0/0xc0
[ 1337.530641] bnxt_re_dealloc_mw+0x2c/0x60 [bnxt_re]
[ 1337.530648] bnxt_re_destroy_fence_mr+0x77/0x1d0 [bnxt_re]
[ 1337.530655] bnxt_re_dealloc_pd+0x25/0x60 [bnxt_re]
[ 1337.530677] ib_dealloc_pd_user+0xbe/0xe0 [ib_core]
[ 1337.530683] srpt_remove_one+0x5de/0x690 [ib_srpt]
[ 1337.530689] ? __srpt_close_all_ch+0xc0/0xc0 [ib_srpt]
[ 1337.530692] ? xa_load+0x87/0xe0
...
[ 1337.530840] do_syscall_64+0x6d/0x1f0
[ 1337.530843] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1337.530845] RIP: 0033:0x7ff5b389035b
[ 1337.530848] Code: 73 01 c3 48 8b 0d 2d 0b 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 0a 2c 00 f7 d8 64 89 01 48
[ 1337.530849] RSP: 002b:00007fff83425c28 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[ 1337.530852] RAX: ffffffffffffffda RBX: 00005596443e6750 RCX: 00007ff5b389035b
[ 1337.530853] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005596443e67b8
[ 1337.530854] RBP: 0000000000000000 R08: 00007fff83424ba1 R09: 0000000000000000
[ 1337.530856] R10: 00007ff5b3902960 R11: 0000000000000206 R12: 00007fff83425e50
[ 1337.530857] R13: 00007fff8342673c R14: 00005596443e6260 R15: 00005596443e6750
[ 1337.530885] The buggy address belongs to the page:
[ 1337.530962] page:ffffea001c951dc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
[ 1337.530964] flags: 0x57ffffc0000000()
[ 1337.530967] raw: 0057ffffc0000000 0000000000000000 ffffffff1c950101 0000000000000000
[ 1337.530970] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 1337.530970] page dumped because: kasan: bad access detected
[ 1337.530996] Memory state around the buggy address:
[ 1337.531072] ffff888725477900: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2
[ 1337.531180] ffff888725477980: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
[ 1337.531288] >ffff888725477a00: 00 f2 f2 f2 f2 f2 f2 00 00 00 f2 00 00 00 00 00
[ 1337.531393] ^
[ 1337.531478] ffff888725477a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1337.531585] ffff888725477b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1337.531691] ==================================================================
Fix this by passing the exact size of each FW command to
bnxt_qplib_rcfw_send_message as req->cmd_size. Before sending
the command to HW, modify the req->cmd_size to number of 16 byte units.
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://lore.kernel.org/r/1566468170-489-1-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 8 +++++++-
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 11 ++++++++---
2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 48b04d2f175f9..60c8f76aab33d 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -136,6 +136,13 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
spin_unlock_irqrestore(&cmdq->lock, flags);
return -EBUSY;
}
+
+ size = req->cmd_size;
+ /* change the cmd_size to the number of 16byte cmdq unit.
+ * req->cmd_size is modified here
+ */
+ bnxt_qplib_set_cmd_slots(req);
+
memset(resp, 0, sizeof(*resp));
crsqe->resp = (struct creq_qp_event *)resp;
crsqe->resp->cookie = req->cookie;
@@ -150,7 +157,6 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
cmdq_ptr = (struct bnxt_qplib_cmdqe **)cmdq->pbl_ptr;
preq = (u8 *)req;
- size = req->cmd_size * BNXT_QPLIB_CMDQE_UNITS;
do {
/* Locate the next cmdq slot */
sw_prod = HWQ_CMP(cmdq->prod, cmdq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index 2138533bb6426..dfeadc192e174 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -55,9 +55,7 @@
do { \
memset(&(req), 0, sizeof((req))); \
(req).opcode = CMDQ_BASE_OPCODE_##CMD; \
- (req).cmd_size = (sizeof((req)) + \
- BNXT_QPLIB_CMDQE_UNITS - 1) / \
- BNXT_QPLIB_CMDQE_UNITS; \
+ (req).cmd_size = sizeof((req)); \
(req).flags = cpu_to_le16(cmd_flags); \
} while (0)
@@ -95,6 +93,13 @@ static inline u32 bnxt_qplib_cmdqe_cnt_per_pg(u32 depth)
BNXT_QPLIB_CMDQE_UNITS);
}
+/* Set the cmd_size to a factor of CMDQE unit */
+static inline void bnxt_qplib_set_cmd_slots(struct cmdq_base *req)
+{
+ req->cmd_size = (req->cmd_size + BNXT_QPLIB_CMDQE_UNITS - 1) /
+ BNXT_QPLIB_CMDQE_UNITS;
+}
+
#define MAX_CMDQ_IDX(depth) ((depth) - 1)
static inline u32 bnxt_qplib_max_cmdq_idx_per_pg(u32 depth)
--
2.20.1
next prev parent reply other threads:[~2019-08-29 18:26 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-29 18:11 [PATCH AUTOSEL 5.2 01/76] batman-adv: Fix netlink dumping of all mcast_flags buckets Sasha Levin
2019-08-29 18:11 ` [PATCH AUTOSEL 5.2 02/76] libbpf: fix erroneous multi-closing of BTF FD Sasha Levin
2019-08-29 18:11 ` [PATCH AUTOSEL 5.2 03/76] libbpf: set BTF FD for prog only when there is supported .BTF.ext data Sasha Levin
2019-08-29 18:11 ` [PATCH AUTOSEL 5.2 04/76] netfilter: nf_flow_table: fix offload for flows that are subject to xfrm Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 05/76] net/mlx5e: Fix error flow of CQE recovery on tx reporter Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 06/76] clk: samsung: Change signature of exynos5_subcmus_init() function Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 07/76] clk: samsung: exynos5800: Move MAU subsystem clocks to MAU sub-CMU Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 08/76] clk: samsung: exynos542x: Move MSCL subsystem clocks to its sub-CMU Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 09/76] net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 10/76] netfilter: nf_tables: use-after-free in failing rule with bound set Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 11/76] netfilter: nf_flow_table: conntrack picks up expired flows Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 12/76] netfilter: nf_flow_table: teardown flow timeout race Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 13/76] rxrpc: Fix local endpoint refcounting Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 14/76] tools: bpftool: fix error message (prog -> object) Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 15/76] ixgbe: fix possible deadlock in ixgbe_service_task() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 16/76] hv_netvsc: Fix a warning of suspicious RCU usage Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 17/76] net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 18/76] Bluetooth: btqca: Add a short delay before downloading the NVM Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 19/76] Bluetooth: hci_qca: Send VS pre shutdown command Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 20/76] Bluetooth: hidp: Let hidp_send_message return number of queued bytes Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 21/76] s390/qeth: serialize cmd reply with concurrent timeout Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 22/76] ibmveth: Convert multicast list size for little-endian system Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 23/76] gpio: Fix build error of function redefinition Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 24/76] netfilter: nft_flow_offload: skip tcp rst and fin packets Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 25/76] rxrpc: Fix local endpoint replacement Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 26/76] rxrpc: Fix read-after-free in rxrpc_queue_local() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 27/76] drm/mediatek: use correct device to import PRIME buffers Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 28/76] drm/mediatek: set DMA max segment size Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 29/76] scsi: qla2xxx: Fix gnl.l memory leak on adapter init failure Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 30/76] scsi: target: tcmu: avoid use-after-free after command timeout Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 31/76] cxgb4: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 32/76] selftests: kvm: do not try running the VM in vmx_set_nested_state_test Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 33/76] selftests: kvm: provide common function to enable eVMCS Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 34/76] selftests: kvm: fix vmx_set_nested_state_test Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 35/76] liquidio: add cleanup in octeon_setup_iq() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 36/76] net: myri10ge: fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 37/76] clk: Fix falling back to legacy parent string matching Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 38/76] clk: Fix potential NULL dereference in clk_fetch_parent_index() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 39/76] lan78xx: Fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 40/76] vfs: fix page locking deadlocks when deduping files Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 41/76] cx82310_eth: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 42/76] net: kalmia: fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 43/76] ibmvnic: Unmap DMA address of TX descriptor buffers after use Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 44/76] net: cavium: fix driver name Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 45/76] wimax/i2400m: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 46/76] ravb: Fix use-after-free ravb_tstamp_skb Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 47/76] sched/core: Schedule new worker even if PI-blocked Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 48/76] kprobes: Fix potential deadlock in kprobe_optimizer() Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 49/76] HID: intel-ish-hid: ipc: add EHL device id Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 50/76] HID: cp2112: prevent sleeping function called from invalid context Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 51/76] x86/boot/compressed/64: Fix boot on machines with broken E820 table Sasha Levin
2019-08-29 22:17 ` Kirill A. Shutemov
2019-08-30 12:06 ` Sasha Levin
2019-08-30 13:25 ` Kirill A. Shutemov
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 52/76] scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 53/76] Input: hyperv-keyboard: Use in-place iterator API in the channel callback Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 54/76] Tools: hv: kvp: eliminate 'may be used uninitialized' warning Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 55/76] io_uring: fix potential hang with polled IO Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 56/76] nvme-multipath: fix possible I/O hang when paths are updated Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 57/76] nvme: Fix cntlid validation when not using NVMEoF Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 58/76] io_uring: don't enter poll loop if we have CQEs pending Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 59/76] RDMA/cma: fix null-ptr-deref Read in cma_cleanup Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 60/76] IB/mlx4: Fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 61/76] infiniband: hfi1: fix a memory leak bug Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 62/76] infiniband: hfi1: fix memory leaks Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 63/76] selftests: kvm: fix state save/load on processors without XSAVE Sasha Levin
2019-08-29 18:12 ` [PATCH AUTOSEL 5.2 64/76] selftests/kvm: make platform_info_test pass on AMD Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 65/76] drm/amdgpu: prevent memory leaks in AMDGPU_CS ioctl Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 66/76] ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() Sasha Levin
2019-08-29 20:51 ` Ilya Dryomov
2019-08-29 21:16 ` Sasha Levin
2019-08-30 8:31 ` Ilya Dryomov
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 67/76] ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob() Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 68/76] ceph: fix buffer free while holding i_ceph_lock in fill_inode() Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 69/76] KVM: arm/arm64: Only skip MMIO insn once Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 70/76] afs: Fix leak in afs_lookup_cell_rcu() Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 71/76] afs: Fix possible oops in afs_lookup trace event Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 72/76] afs: use correct afs_call_type in yfs_fs_store_opaque_acl2 Sasha Levin
2019-08-29 18:13 ` Sasha Levin [this message]
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 74/76] io_uring: add need_resched() check in inner poll loop Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 75/76] gpio: Fix irqchip initialization order Sasha Levin
2019-08-29 18:13 ` [PATCH AUTOSEL 5.2 76/76] KVM: arm/arm64: VGIC: Properly initialise private IRQ affinity Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190829181311.7562-73-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dledford@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=selvin.xavier@broadcom.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).