[PATCH v2 1/1] RDMA/rxe: Fix the use-before-initialization error of resp_pkts

[PATCH v2 1/1] RDMA/rxe: Fix the use-before-initialization error of resp_pkts

[Zhu Yanjun]

From: Zhu Yanjun <yanjun.zhu@linux.dev>

In the following:
"
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 assign_lock_key kernel/locking/lockdep.c:982 [inline]
 register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
 __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
 lock_acquire kernel/locking/lockdep.c:5691 [inline]
 lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
 skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
 drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
 rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
 rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
 execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
 __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
 rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
...
"
This is a use-before-initialization problem.

In the following function
"
291 /* called by the create qp verb */
292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
struct rxe_pd *pd,
297 {
            ...
317         rxe_qp_init_misc(rxe, qp, init);
            ...
322
323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
324         if (err)
325                 goto err2;   <--- error

            ...

334 err2:
335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
336         qp->sq.queue = NULL;
"
In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
So this call trace appeared.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Reported-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com
Link: https://lore.kernel.org/lkml/000000000000235bce05fac5f850@google.com/T/
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
---
V1->V2: Add Fixes and Link.
---
 drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index 61a2eb77d999..a0f206431cf8 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp,
 	spin_lock_init(&qp->rq.producer_lock);
 	spin_lock_init(&qp->rq.consumer_lock);
 
+	skb_queue_head_init(&qp->req_pkts);
+	skb_queue_head_init(&qp->resp_pkts);
+
 	atomic_set(&qp->ssn, 0);
 	atomic_set(&qp->skb_out, 0);
 }
@@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
 	qp->req.opcode		= -1;
 	qp->comp.opcode		= -1;
 
-	skb_queue_head_init(&qp->req_pkts);
-
 	rxe_init_task(&qp->req.task, qp, rxe_requester);
 	rxe_init_task(&qp->comp.task, qp, rxe_completer);
 
@@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
 		}
 	}
 
-	skb_queue_head_init(&qp->resp_pkts);
-
 	rxe_init_task(&qp->resp.task, qp, rxe_responder);
 
 	qp->resp.opcode		= OPCODE_NONE;
-- 
2.27.0

Re: [PATCH v2 1/1] RDMA/rxe: Fix the use-before-initialization error of resp_pkts

[Jason Gunthorpe]

On Fri, Jun 02, 2023 at 11:54:08AM +0800, Zhu Yanjun wrote:
> From: Zhu Yanjun <yanjun.zhu@linux.dev>
> 
> In the following:
> "
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
>  assign_lock_key kernel/locking/lockdep.c:982 [inline]
>  register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
>  __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
>  lock_acquire kernel/locking/lockdep.c:5691 [inline]
>  lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
>  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>  _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
>  skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
>  drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
>  rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
>  rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
>  execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
>  __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
>  rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
> ...
> "
> This is a use-before-initialization problem.
> 
> In the following function
> "
> 291 /* called by the create qp verb */
> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> struct rxe_pd *pd,
> 297 {
>             ...
> 317         rxe_qp_init_misc(rxe, qp, init);
>             ...
> 322
> 323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> 324         if (err)
> 325                 goto err2;   <--- error
> 
>             ...
> 
> 334 err2:
> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> 336         qp->sq.queue = NULL;
> "
> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> So this call trace appeared.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Reported-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com
> Link: https://lore.kernel.org/lkml/000000000000235bce05fac5f850@google.com/T/
> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
> ---
> V1->V2: Add Fixes and Link.
> ---
>  drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)

Applied to for-rc, thanks

Jason

Re: [PATCH v2 1/1] RDMA/rxe: Fix the use-before-initialization error of resp_pkts

[Zhu Yanjun]

在 2023/6/10 1:04, Jason Gunthorpe 写道:
> On Fri, Jun 02, 2023 at 11:54:08AM +0800, Zhu Yanjun wrote:
>> From: Zhu Yanjun <yanjun.zhu@linux.dev>
>>
>> In the following:
>> "
>> Call Trace:
>>   <TASK>
>>   __dump_stack lib/dump_stack.c:88 [inline]
>>   dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
>>   assign_lock_key kernel/locking/lockdep.c:982 [inline]
>>   register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
>>   __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
>>   lock_acquire kernel/locking/lockdep.c:5691 [inline]
>>   lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
>>   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>>   _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
>>   skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
>>   drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
>>   rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
>>   rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
>>   execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
>>   __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
>>   rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
>> ...
>> "
>> This is a use-before-initialization problem.
>>
>> In the following function
>> "
>> 291 /* called by the create qp verb */
>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
>> struct rxe_pd *pd,
>> 297 {
>>              ...
>> 317         rxe_qp_init_misc(rxe, qp, init);
>>              ...
>> 322
>> 323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
>> 324         if (err)
>> 325                 goto err2;   <--- error
>>
>>              ...
>>
>> 334 err2:
>> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
>> 336         qp->sq.queue = NULL;
>> "
>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
>> So this call trace appeared.
>>
>> Fixes: 8700e3e7c485 ("Soft RoCE driver")
>> Reported-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com
>> Link: https://lore.kernel.org/lkml/000000000000235bce05fac5f850@google.com/T/
>> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
>> ---
>> V1->V2: Add Fixes and Link.
>> ---
>>   drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++----
>>   1 file changed, 3 insertions(+), 4 deletions(-)
> 
> Applied to for-rc, thanks

Thanks.

Zhu Yanjun

> 
> Jason