From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, stable@kernel.org,
Di Zhu <zhudi21@huawei.com>,
Shiraz Saleem <shiraz.saleem@intel.com>,
Jason Gunthorpe <jgg@nvidia.com>
Subject: [PATCH 4.19 32/32] RDMA/i40iw: Address an mmap handler exploit in i40iw
Date: Sun, 6 Dec 2020 12:17:32 +0100 [thread overview]
Message-ID: <20201206111557.314085437@linuxfoundation.org> (raw)
In-Reply-To: <20201206111555.787862631@linuxfoundation.org>
From: Shiraz Saleem <shiraz.saleem@intel.com>
commit 2ed381439e89fa6d1a0839ef45ccd45d99d8e915 upstream.
i40iw_mmap manipulates the vma->vm_pgoff to differentiate a push page mmap
vs a doorbell mmap, and uses it to compute the pfn in remap_pfn_range
without any validation. This is vulnerable to an mmap exploit as described
in: https://lore.kernel.org/r/20201119093523.7588-1-zhudi21@huawei.com
The push feature is disabled in the driver currently and therefore no push
mmaps are issued from user-space. The feature does not work as expected in
the x722 product.
Remove the push module parameter and all VMA attribute manipulations for
this feature in i40iw_mmap. Update i40iw_mmap to only allow DB user
mmapings at offset = 0. Check vm_pgoff for zero and if the mmaps are bound
to a single page.
Cc: <stable@kernel.org>
Fixes: d37498417947 ("i40iw: add files for iwarp interface")
Link: https://lore.kernel.org/r/20201125005616.1800-2-shiraz.saleem@intel.com
Reported-by: Di Zhu <zhudi21@huawei.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/i40iw/i40iw_main.c | 5 ----
drivers/infiniband/hw/i40iw/i40iw_verbs.c | 36 +++++-------------------------
2 files changed, 7 insertions(+), 34 deletions(-)
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -54,10 +54,6 @@
#define DRV_VERSION __stringify(DRV_VERSION_MAJOR) "." \
__stringify(DRV_VERSION_MINOR) "." __stringify(DRV_VERSION_BUILD)
-static int push_mode;
-module_param(push_mode, int, 0644);
-MODULE_PARM_DESC(push_mode, "Low latency mode: 0=disabled (default), 1=enabled)");
-
static int debug;
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "debug flags: 0=disabled (default), 0x7fffffff=all");
@@ -1584,7 +1580,6 @@ static enum i40iw_status_code i40iw_setu
if (status)
goto exit;
iwdev->obj_next = iwdev->obj_mem;
- iwdev->push_mode = push_mode;
init_waitqueue_head(&iwdev->vchnl_waitq);
init_waitqueue_head(&dev->vf_reqs);
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -201,38 +201,16 @@ static int i40iw_dealloc_ucontext(struct
*/
static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
{
- struct i40iw_ucontext *ucontext;
- u64 db_addr_offset;
- u64 push_offset;
+ struct i40iw_ucontext *ucontext = to_ucontext(context);
+ u64 dbaddr;
- ucontext = to_ucontext(context);
- if (ucontext->iwdev->sc_dev.is_pf) {
- db_addr_offset = I40IW_DB_ADDR_OFFSET;
- push_offset = I40IW_PUSH_OFFSET;
- if (vma->vm_pgoff)
- vma->vm_pgoff += I40IW_PF_FIRST_PUSH_PAGE_INDEX - 1;
- } else {
- db_addr_offset = I40IW_VF_DB_ADDR_OFFSET;
- push_offset = I40IW_VF_PUSH_OFFSET;
- if (vma->vm_pgoff)
- vma->vm_pgoff += I40IW_VF_FIRST_PUSH_PAGE_INDEX - 1;
- }
+ if (vma->vm_pgoff || vma->vm_end - vma->vm_start != PAGE_SIZE)
+ return -EINVAL;
- vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT;
+ dbaddr = I40IW_DB_ADDR_OFFSET + pci_resource_start(ucontext->iwdev->ldev->pcidev, 0);
- if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) {
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- vma->vm_private_data = ucontext;
- } else {
- if ((vma->vm_pgoff - (push_offset >> PAGE_SHIFT)) % 2)
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- else
- vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
- }
-
- if (io_remap_pfn_range(vma, vma->vm_start,
- vma->vm_pgoff + (pci_resource_start(ucontext->iwdev->ldev->pcidev, 0) >> PAGE_SHIFT),
- PAGE_SIZE, vma->vm_page_prot))
+ if (io_remap_pfn_range(vma, vma->vm_start, dbaddr >> PAGE_SHIFT, PAGE_SIZE,
+ pgprot_noncached(vma->vm_page_prot)))
return -EAGAIN;
return 0;
next prev parent reply other threads:[~2020-12-06 11:40 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-06 11:17 [PATCH 4.19 00/32] 4.19.162-rc1 review Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 01/32] ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 02/32] net/af_iucv: set correct sk_protocol for child sockets Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 03/32] net/tls: missing received data after fast remote close Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 04/32] rose: Fix Null pointer dereference in rose_send_frame() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 05/32] sock: set sk_err to ee_errno on dequeue from errq Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 06/32] tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 07/32] tun: honor IOCB_NOWAIT flag Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 08/32] usbnet: ipheth: fix connectivity with iOS 14 Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 09/32] net/tls: Protect from calling tls_dev_del for TLS RX twice Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 10/32] ibmvnic: fix call_netdevice_notifiers in do_reset Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 11/32] ibmvnic: notify peers when failover and migration happen Greg Kroah-Hartman
2020-12-06 17:07 ` Pavel Machek
2020-12-08 9:06 ` Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 12/32] i40e: Fix removing driver while bare-metal VFs pass traffic Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 13/32] bonding: wait for sysfs kobject destruction before freeing struct slave Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 14/32] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 15/32] ipv4: Fix tos mask in inet_rtm_getroute() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 16/32] ibmvnic: Ensure that SCRQ entry reads are correctly ordered Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 17/32] ibmvnic: Fix TX completion error handling Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 18/32] geneve: pull IP header before ECN decapsulation Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 19/32] net: ip6_gre: set dev->hard_header_len when using header_ops Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 20/32] net/x25: prevent a couple of overflows Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 21/32] cxgb3: fix error return code in t3_sge_alloc_qset() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 22/32] net: pasemi: fix error return code in pasemi_mac_open() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 23/32] chelsio/chtls: fix a double free in chtls_setkey() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 24/32] net: mvpp2: Fix error return code in mvpp2_open() Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 25/32] net/mlx5: Fix wrong address reclaim when command interface is down Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 26/32] chelsio/chtls: fix panic during unload reload chtls Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 27/32] dt-bindings: net: correct interrupt flags in examples Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 28/32] ALSA: usb-audio: US16x08: fix value count for level meters Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 29/32] Input: xpad - support Ardwiino Controllers Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 30/32] Input: i8042 - add ByteSpeed touchpad to noloop table Greg Kroah-Hartman
2020-12-06 11:17 ` [PATCH 4.19 31/32] tracing: Remove WARN_ON in start_thread() Greg Kroah-Hartman
2020-12-06 11:17 ` Greg Kroah-Hartman [this message]
2020-12-07 8:30 ` [PATCH 4.19 00/32] 4.19.162-rc1 review Pavel Machek
2020-12-08 9:24 ` Greg Kroah-Hartman
2020-12-07 9:46 ` Naresh Kamboju
2020-12-07 15:04 ` Jon Hunter
2020-12-07 15:54 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201206111557.314085437@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=shiraz.saleem@intel.com \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
--cc=zhudi21@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).