* [PATCH 1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
@ 2025-04-12 7:57 Zhu Yanjun
2025-04-14 10:49 ` Daisuke Matsuda (Fujitsu)
2025-04-20 10:11 ` Leon Romanovsky
0 siblings, 2 replies; 4+ messages in thread
From: Zhu Yanjun @ 2025-04-12 7:57 UTC (permalink / raw)
To: zyjzyj2000, jgg, leon, linux-rdma; +Cc: Zhu Yanjun, liuyi
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcf/0x610 mm/kasan/report.c:489
kasan_report+0xb5/0xe0 mm/kasan/report.c:602
rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195
rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132
__rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232
rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109
create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052
ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095
ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679
vfs_write fs/read_write.c:677 [inline]
vfs_write+0x26a/0xcc0 fs/read_write.c:659
ksys_write+0x1b8/0x200 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
In the function rxe_create_cq, when rxe_cq_from_init fails, the function
rxe_cleanup will be called to handle the allocated resources. In fact,
some memory resources have already been freed in the function
rxe_cq_from_init. Thus, this problem will occur.
The solution is to let rxe_cleanup do all the work.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://paste.ubuntu.com/p/tJgC42wDf6/
Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn>
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
---
drivers/infiniband/sw/rxe/rxe_cq.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
index fec87c9030ab..fffd144d509e 100644
--- a/drivers/infiniband/sw/rxe/rxe_cq.c
+++ b/drivers/infiniband/sw/rxe/rxe_cq.c
@@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata,
cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
- if (err) {
- vfree(cq->queue->buf);
- kfree(cq->queue);
+ if (err)
return err;
- }
cq->is_user = uresp;
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH 1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
2025-04-12 7:57 [PATCH 1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Zhu Yanjun
@ 2025-04-14 10:49 ` Daisuke Matsuda (Fujitsu)
2025-04-14 12:58 ` Zhu Yanjun
2025-04-20 10:11 ` Leon Romanovsky
1 sibling, 1 reply; 4+ messages in thread
From: Daisuke Matsuda (Fujitsu) @ 2025-04-14 10:49 UTC (permalink / raw)
To: 'Zhu Yanjun', zyjzyj2000@gmail.com, jgg@ziepe.ca,
leon@kernel.org, linux-rdma@vger.kernel.org
Cc: liuyi
On Sat, April 12, 2025 4:57 PM Zhu Yanjun wrote:
>
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0xcf/0x610 mm/kasan/report.c:489
> kasan_report+0xb5/0xe0 mm/kasan/report.c:602
> rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195
> rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132
> __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232
> rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109
> create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052
> ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095
> ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679
> vfs_write fs/read_write.c:677 [inline]
> vfs_write+0x26a/0xcc0 fs/read_write.c:659
> ksys_write+0x1b8/0x200 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> In the function rxe_create_cq, when rxe_cq_from_init fails, the function
> rxe_cleanup will be called to handle the allocated resources. In fact,
> some memory resources have already been freed in the function
> rxe_cq_from_init. Thus, this problem will occur.
>
> The solution is to let rxe_cleanup do all the work.
>
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Link: https://paste.ubuntu.com/p/tJgC42wDf6/
> Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn>
> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
The fix looks correct.
Thank you.
> ---
> drivers/infiniband/sw/rxe/rxe_cq.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
> index fec87c9030ab..fffd144d509e 100644
> --- a/drivers/infiniband/sw/rxe/rxe_cq.c
> +++ b/drivers/infiniband/sw/rxe/rxe_cq.c
> @@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
>
> err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata,
> cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
> - if (err) {
> - vfree(cq->queue->buf);
> - kfree(cq->queue);
> + if (err)
> return err;
> - }
>
> cq->is_user = uresp;
>
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
2025-04-14 10:49 ` Daisuke Matsuda (Fujitsu)
@ 2025-04-14 12:58 ` Zhu Yanjun
0 siblings, 0 replies; 4+ messages in thread
From: Zhu Yanjun @ 2025-04-14 12:58 UTC (permalink / raw)
To: Daisuke Matsuda (Fujitsu), zyjzyj2000@gmail.com, jgg@ziepe.ca,
leon@kernel.org, linux-rdma@vger.kernel.org
Cc: liuyi
On 14.04.25 12:49, Daisuke Matsuda (Fujitsu) wrote:
> On Sat, April 12, 2025 4:57 PM Zhu Yanjun wrote:
>>
>> Call Trace:
>> <TASK>
>> __dump_stack lib/dump_stack.c:94 [inline]
>> dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120
>> print_address_description mm/kasan/report.c:378 [inline]
>> print_report+0xcf/0x610 mm/kasan/report.c:489
>> kasan_report+0xb5/0xe0 mm/kasan/report.c:602
>> rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195
>> rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132
>> __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232
>> rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109
>> create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052
>> ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095
>> ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679
>> vfs_write fs/read_write.c:677 [inline]
>> vfs_write+0x26a/0xcc0 fs/read_write.c:659
>> ksys_write+0x1b8/0x200 fs/read_write.c:731
>> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>> do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
>> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>>
>> In the function rxe_create_cq, when rxe_cq_from_init fails, the function
>> rxe_cleanup will be called to handle the allocated resources. In fact,
>> some memory resources have already been freed in the function
>> rxe_cq_from_init. Thus, this problem will occur.
>>
>> The solution is to let rxe_cleanup do all the work.
>>
>> Fixes: 8700e3e7c485 ("Soft RoCE driver")
>> Link: https://paste.ubuntu.com/p/tJgC42wDf6/
>> Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn>
>> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
>
> Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
>
> The fix looks correct.
Thanks a lot.
Zhu Yanjun
> Thank you.
>
>> ---
>> drivers/infiniband/sw/rxe/rxe_cq.c | 5 +----
>> 1 file changed, 1 insertion(+), 4 deletions(-)
>>
>> diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
>> index fec87c9030ab..fffd144d509e 100644
>> --- a/drivers/infiniband/sw/rxe/rxe_cq.c
>> +++ b/drivers/infiniband/sw/rxe/rxe_cq.c
>> @@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
>>
>> err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata,
>> cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
>> - if (err) {
>> - vfree(cq->queue->buf);
>> - kfree(cq->queue);
>> + if (err)
>> return err;
>> - }
>>
>> cq->is_user = uresp;
>>
>> --
>> 2.34.1
>>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
2025-04-12 7:57 [PATCH 1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Zhu Yanjun
2025-04-14 10:49 ` Daisuke Matsuda (Fujitsu)
@ 2025-04-20 10:11 ` Leon Romanovsky
1 sibling, 0 replies; 4+ messages in thread
From: Leon Romanovsky @ 2025-04-20 10:11 UTC (permalink / raw)
To: zyjzyj2000, jgg, linux-rdma, Zhu Yanjun; +Cc: liuyi
On Sat, 12 Apr 2025 09:57:14 +0200, Zhu Yanjun wrote:
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0xcf/0x610 mm/kasan/report.c:489
> kasan_report+0xb5/0xe0 mm/kasan/report.c:602
> rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195
> rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132
> __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232
> rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109
> create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052
> ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095
> ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679
> vfs_write fs/read_write.c:677 [inline]
> vfs_write+0x26a/0xcc0 fs/read_write.c:659
> ksys_write+0x1b8/0x200 fs/read_write.c:731
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> [...]
Applied, thanks!
[1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
https://git.kernel.org/rdma/rdma/c/c95366ddbe99ba
Best regards,
--
Leon Romanovsky <leon@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-04-20 10:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-12 7:57 [PATCH 1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Zhu Yanjun
2025-04-14 10:49 ` Daisuke Matsuda (Fujitsu)
2025-04-14 12:58 ` Zhu Yanjun
2025-04-20 10:11 ` Leon Romanovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox