From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, syzkaller <syzkaller@googlegroups.com>,
Noa Osherovich <noaos@mellanox.com>,
Leon Romanovsky <leonro@mellanox.com>,
Jason Gunthorpe <jgg@mellanox.com>
Subject: [PATCH 4.14 20/54] RDMA/uverbs: Sanitize user entered port numbers prior to access it
Date: Mon, 26 Feb 2018 21:21:57 +0100 [thread overview]
Message-ID: <20180226202145.395642961@linuxfoundation.org> (raw)
In-Reply-To: <20180226202144.375869933@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 5d4c05c3ee36f67ddc107ab5ea0898af01a62cc1 upstream.
==================================================================
BUG: KASAN: use-after-free in copy_ah_attr_from_uverbs+0x6f2/0x8c0
Read of size 4 at addr ffff88006476a198 by task syzkaller697701/265
CPU: 0 PID: 265 Comm: syzkaller697701 Not tainted 4.15.0+ #90
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Call Trace:
dump_stack+0xde/0x164
? dma_virt_map_sg+0x22c/0x22c
? show_regs_print_info+0x17/0x17
? lock_contended+0x11a0/0x11a0
print_address_description+0x83/0x3e0
kasan_report+0x18c/0x4b0
? copy_ah_attr_from_uverbs+0x6f2/0x8c0
? copy_ah_attr_from_uverbs+0x6f2/0x8c0
? lookup_get_idr_uobject+0x120/0x200
? copy_ah_attr_from_uverbs+0x6f2/0x8c0
copy_ah_attr_from_uverbs+0x6f2/0x8c0
? modify_qp+0xd0e/0x1350
modify_qp+0xd0e/0x1350
ib_uverbs_modify_qp+0xf9/0x170
? ib_uverbs_query_qp+0xa70/0xa70
ib_uverbs_write+0x7f9/0xef0
? attach_entity_load_avg+0x8b0/0x8b0
? ib_uverbs_query_qp+0xa70/0xa70
? uverbs_devnode+0x110/0x110
? cyc2ns_read_end+0x10/0x10
? print_irqtrace_events+0x280/0x280
? sched_clock_cpu+0x18/0x200
? _raw_spin_unlock_irq+0x29/0x40
? _raw_spin_unlock_irq+0x29/0x40
? _raw_spin_unlock_irq+0x29/0x40
? time_hardirqs_on+0x27/0x670
__vfs_write+0x10d/0x700
? uverbs_devnode+0x110/0x110
? kernel_read+0x170/0x170
? _raw_spin_unlock_irq+0x29/0x40
? finish_task_switch+0x1bd/0x7a0
? finish_task_switch+0x194/0x7a0
? prandom_u32_state+0xe/0x180
? rcu_read_unlock+0x80/0x80
? security_file_permission+0x93/0x260
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
? SyS_read+0x1a0/0x1a0
? trace_hardirqs_on_thunk+0x1a/0x1c
entry_SYSCALL_64_fastpath+0x1e/0x8b
RIP: 0033:0x433c29
RSP: 002b:00007ffcf2be82a8 EFLAGS: 00000217
Allocated by task 62:
kasan_kmalloc+0xa0/0xd0
kmem_cache_alloc+0x141/0x480
dup_fd+0x101/0xcc0
copy_process.part.62+0x166f/0x4390
_do_fork+0x1cb/0xe90
kernel_thread+0x34/0x40
call_usermodehelper_exec_work+0x112/0x260
process_one_work+0x929/0x1aa0
worker_thread+0x5c6/0x12a0
kthread+0x346/0x510
ret_from_fork+0x3a/0x50
Freed by task 259:
kasan_slab_free+0x71/0xc0
kmem_cache_free+0xf3/0x4c0
put_files_struct+0x225/0x2c0
exit_files+0x88/0xc0
do_exit+0x67c/0x1520
do_group_exit+0xe8/0x380
SyS_exit_group+0x1e/0x20
entry_SYSCALL_64_fastpath+0x1e/0x8b
The buggy address belongs to the object at ffff88006476a000
which belongs to the cache files_cache of size 832
The buggy address is located 408 bytes inside of
832-byte region [ffff88006476a000, ffff88006476a340)
The buggy address belongs to the page:
page:ffffea000191da80 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000008100(slab|head)
raw: 4000000000008100 0000000000000000 0000000000000000 0000000100080008
raw: 0000000000000000 0000000100000001 ffff88006bcf7a80 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88006476a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88006476a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88006476a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88006476a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88006476a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # 4.11
Fixes: 44c58487d51a ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/uverbs_cmd.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1981,8 +1981,15 @@ static int modify_qp(struct ib_uverbs_fi
goto release_qp;
}
+ if ((cmd->base.attr_mask & IB_QP_AV) &&
+ !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
+ ret = -EINVAL;
+ goto release_qp;
+ }
+
if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
- !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+ (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) ||
+ !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) {
ret = -EINVAL;
goto release_qp;
}
next prev parent reply other threads:[~2018-02-26 20:21 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-26 20:21 [PATCH 4.14 00/54] 4.14.23-stable review Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 01/54] netfilter: drop outermost socket lock in getsockopt() Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 02/54] arm64: mm: dont write garbage into TTBR1_EL1 register Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 03/54] kconfig.h: Include compiler types to avoid missed struct attributes Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 04/54] MIPS: boot: Define __ASSEMBLY__ for its.S build Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 05/54] xtensa: fix high memory/reserved memory collision Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 06/54] scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 07/54] MIPS: Drop spurious __unused in struct compat_flock Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 08/54] cfg80211: fix cfg80211_beacon_dup Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 09/54] i2c: designware: must wait for enable Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 10/54] i2c: bcm2835: Set up the rising/falling edge delays Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 11/54] X.509: fix BUG_ON() when hash algorithm is unsupported Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 12/54] X.509: fix NULL dereference when restricting key with unsupported_sig Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 13/54] PKCS#7: fix certificate chain verification Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 14/54] PKCS#7: fix certificate blacklisting Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 15/54] extcon: int3496: process id-pin first so that we start with the right status Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 16/54] RDMA/uverbs: Protect from races between lookup and destroy of uobjects Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 17/54] RDMA/uverbs: Protect from command mask overflow Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 18/54] RDMA/uverbs: Fix bad unlock balance in ib_uverbs_close_xrcd Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 19/54] RDMA/uverbs: Fix circular locking dependency Greg Kroah-Hartman
2018-02-26 20:21 ` Greg Kroah-Hartman [this message]
2018-02-26 20:21 ` [PATCH 4.14 21/54] iio: adc: stm32: fix stm32h7_adc_enable error handling Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.14 22/54] iio: srf08: fix link error "devm_iio_triggered_buffer_setup" undefined Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 23/54] iio: buffer: check if a buffer has been set up when poll is called Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 24/54] iio: adis_lib: Initialize trigger before requesting interrupt Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 25/54] Kbuild: always define endianess in kconfig.h Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 26/54] x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 27/54] mm, swap, frontswap: fix THP swap if frontswap enabled Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 28/54] irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 29/54] irqchip/mips-gic: Avoid spuriously handling masked interrupts Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 30/54] PCI/cxgb4: Extend T3 PCI quirk to T4+ devices Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 31/54] ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 32/54] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 33/54] arm64: Remove unimplemented syscall log message Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 34/54] arm64: Disable unhandled signal log messages by default Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 35/54] arm64: cpufeature: Fix CTR_EL0 field definitions Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 36/54] Add delay-init quirk for Corsair K70 RGB keyboards Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 37/54] drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 38/54] usb: host: ehci: use correct device pointer for dma ops Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 39/54] usb: dwc3: gadget: Set maxpacket size for ep0 IN Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 40/54] usb: dwc3: ep0: Reset TRB counter " Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 41/54] usb: ldusb: add PIDs for new CASSY devices supported by this driver Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 42/54] Revert "usb: musb: host: dont start next rx urb if current one failed" Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 43/54] usb: gadget: f_fs: Process all descriptors during bind Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 44/54] usb: gadget: f_fs: Use config_ep_by_speed() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 45/54] usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 46/54] drm/cirrus: Load lut in crtc_commit Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 47/54] drm: Handle unexpected holes in color-eviction Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 48/54] drm/amdgpu: disable MMHUB power gating on raven Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 49/54] drm/amdgpu: Add dpm quirk for Jet PRO (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 50/54] drm/amdgpu: only check mmBIF_IOV_FUNC_IDENTIFIER on tonga/fiji Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 51/54] drm/amdgpu: add atpx quirk handling (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 52/54] drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 53/54] drm/amdgpu: add new device to use atpx quirk Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.14 54/54] drm/i915/breadcrumbs: Ignore unsubmitted signalers Greg Kroah-Hartman
2018-02-26 20:58 ` [PATCH 4.14 00/54] 4.14.23-stable review Dan Murphy
2018-02-26 21:19 ` Guenter Roeck
2018-02-26 21:45 ` Tony Lindgren
2018-02-26 21:56 ` Dan Murphy
2018-02-27 13:14 ` Greg Kroah-Hartman
2018-02-27 0:57 ` Shuah Khan
2018-02-27 6:58 ` kernelci.org bot
2018-02-27 7:10 ` Naresh Kamboju
2018-02-27 10:59 ` Guenter Roeck
2018-02-27 13:08 ` Greg Kroah-Hartman
2018-02-27 14:34 ` Guenter Roeck
2018-02-27 14:38 ` Guenter Roeck
2018-02-27 18:36 ` Greg Kroah-Hartman
2018-02-27 19:12 ` Guenter Roeck
2018-02-27 23:12 ` Guenter Roeck
2018-02-28 7:12 ` Greg Kroah-Hartman
2018-02-27 14:57 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180226202145.395642961@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=noaos@mellanox.com \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox