From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+aab53008a5adf26abe91@syzkaller.appspotmail.com,
Pavel Skripkin <paskripkin@gmail.com>,
Zhu Yanjun <zyjzyj2000@gmail.com>,
Jason Gunthorpe <jgg@nvidia.com>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15 03/42] RDMA: Fix use-after-free in rxe_queue_cleanup
Date: Wed, 15 Dec 2021 18:20:44 +0100 [thread overview]
Message-ID: <20211215172026.757832323@linuxfoundation.org> (raw)
In-Reply-To: <20211215172026.641863587@linuxfoundation.org>
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 84b01721e8042cdd1e8ffeb648844a09cd4213e0 ]
On error handling path in rxe_qp_from_init() qp->sq.queue is freed and
then rxe_create_qp() will drop last reference to this object. qp clean up
function will try to free this queue one time and it causes UAF bug.
Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().
Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory")
Link: https://lore.kernel.org/r/20211121202239.3129-1-paskripkin@gmail.com
Reported-by: syzbot+aab53008a5adf26abe91@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Zhu Yanjun <zyjzyj2000@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_qp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index 1ab6af7ddb254..ed326d82725cd 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -367,6 +367,7 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd,
err2:
rxe_queue_cleanup(qp->sq.queue);
+ qp->sq.queue = NULL;
err1:
qp->pd = NULL;
qp->rcq = NULL;
--
2.33.0
next prev parent reply other threads:[~2021-12-15 17:23 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-15 17:20 [PATCH 5.15 00/42] 5.15.9-rc1 review Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 01/42] nfc: fix segfault in nfc_genl_dump_devices_done Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 02/42] hwmon: (corsair-psu) fix plain integer used as NULL pointer Greg Kroah-Hartman
2021-12-15 17:20 ` Greg Kroah-Hartman [this message]
2021-12-15 17:20 ` [PATCH 5.15 04/42] RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow Greg Kroah-Hartman
2022-01-01 10:56 ` Thorsten Leemhuis
2022-01-07 5:57 ` Thorsten Leemhuis
2022-01-07 10:57 ` Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 05/42] mtd: rawnand: Fix nand_erase_op delay Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 06/42] mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 07/42] inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 08/42] dt-bindings: media: nxp,imx7-mipi-csi2: Drop bad if/then schema Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 09/42] clk: qcom: sm6125-gcc: Swap ops of ice and apps on sdcc1 Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 10/42] perf bpf_skel: Do not use typedef to avoid error on old clang Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 11/42] netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 12/42] RDMA/irdma: Fix a user-after-free in add_pble_prm Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 13/42] RDMA/irdma: Fix a potential memory allocation issue in irdma_prm_add_pble_mem() Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 14/42] RDMA/irdma: Report correct WC errors Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 15/42] RDMA/irdma: Dont arm the CQ more than two times if no CE for this CQ Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 16/42] ice: fix FDIR init missing when reset VF Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 17/42] vmxnet3: fix minimum vectors alloc issue Greg Kroah-Hartman
2021-12-15 17:20 ` [PATCH 5.15 18/42] i2c: virtio: fix completion handling Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 19/42] drm/msm: Fix null ptr access msm_ioctl_gem_submit() Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 20/42] drm/msm/a6xx: Fix uinitialized use of gpu_scid Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 21/42] drm/msm/dsi: set default num_data_lanes Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 22/42] drm/msm/dp: Avoid unpowered AUX xfers that caused crashes Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 23/42] KVM: arm64: Save PSTATE early on exit Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 24/42] s390/test_unwind: use raw opcode instead of invalid instruction Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 25/42] Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP" Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 26/42] net/mlx4_en: Update reported link modes for 1/10G Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 27/42] loop: Use pr_warn_once() for loop_control_remove() warning Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 28/42] ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 29/42] ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 30/42] parisc/agp: Annotate parisc agp init functions with __init Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 31/42] i2c: rk3x: Handle a spurious start completion interrupt flag Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 32/42] net: netlink: af_netlink: Prevent empty skb by adding a check on len Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 33/42] drm/amdgpu: cancel the correct hrtimer on exit Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 34/42] drm/amdgpu: check atomic flag to differeniate with legacy path Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 35/42] drm/amd/display: Fix for the no Audio bug with Tiled Displays Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 36/42] drm/amdkfd: fix double free mem structure Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 37/42] drm/amd/display: add connector type check for CRC source set Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 38/42] drm/amdkfd: process_info lock not needed for svm Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 39/42] tracing: Fix a kmemleak false positive in tracing_map Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 40/42] staging: most: dim2: use device release method Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 41/42] fuse: make sure reclaim doesnt write the inode Greg Kroah-Hartman
2021-12-15 17:21 ` [PATCH 5.15 42/42] perf inject: Fix itrace space allowed for new attributes Greg Kroah-Hartman
2021-12-15 20:01 ` [PATCH 5.15 00/42] 5.15.9-rc1 review Jon Hunter
2021-12-15 21:51 ` Shuah Khan
2021-12-15 23:03 ` Fox Chen
2021-12-15 23:46 ` Florian Fainelli
2021-12-16 3:08 ` Naresh Kamboju
2021-12-16 18:08 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211215172026.757832323@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=paskripkin@gmail.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+aab53008a5adf26abe91@syzkaller.appspotmail.com \
--cc=zyjzyj2000@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).