From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Mark Zhang <markzhang@nvidia.com>,
Mark Bloch <mbloch@nvidia.com>,
Leon Romanovsky <leonro@nvidia.com>,
Jason Gunthorpe <jgg@nvidia.com>
Subject: [PATCH 5.10 53/77] RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string
Date: Mon, 1 Nov 2021 10:17:41 +0100 [thread overview]
Message-ID: <20211101082522.807183069@linuxfoundation.org> (raw)
In-Reply-To: <20211101082511.254155853@linuxfoundation.org>
From: Mark Zhang <markzhang@nvidia.com>
commit 64733956ebba7cc629856f4a6ee35a52bc9c023f upstream.
When copying the device name, the length of the data memcpy copied exceeds
the length of the source buffer, which cause the KASAN issue below. Use
strscpy_pad() instead.
BUG: KASAN: slab-out-of-bounds in ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
Read of size 64 at addr ffff88811a10f5e0 by task rping/140263
CPU: 3 PID: 140263 Comm: rping Not tainted 5.15.0-rc1+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0+0x1d/0xa0
kasan_report+0xcb/0x110
kasan_check_range+0x13d/0x180
memcpy+0x20/0x60
ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
ib_nl_make_request+0x1c6/0x380 [ib_core]
send_mad+0x20a/0x220 [ib_core]
ib_sa_path_rec_get+0x3e3/0x800 [ib_core]
cma_query_ib_route+0x29b/0x390 [rdma_cm]
rdma_resolve_route+0x308/0x3e0 [rdma_cm]
ucma_resolve_route+0xe1/0x150 [rdma_ucm]
ucma_write+0x17b/0x1f0 [rdma_ucm]
vfs_write+0x142/0x4d0
ksys_write+0x133/0x160
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f26499aa90f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c fd ff ff 48
RSP: 002b:00007f26495f2dc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000000007d0 RCX: 00007f26499aa90f
RDX: 0000000000000010 RSI: 00007f26495f2e00 RDI: 0000000000000003
RBP: 00005632a8315440 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f26495f2e00
R13: 00005632a83154e0 R14: 00005632a8315440 R15: 00005632a830a810
Allocated by task 131419:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
proc_self_get_link+0x8b/0x100
pick_link+0x4f1/0x5c0
step_into+0x2eb/0x3d0
walk_component+0xc8/0x2c0
link_path_walk+0x3b8/0x580
path_openat+0x101/0x230
do_filp_open+0x12e/0x240
do_sys_openat2+0x115/0x280
__x64_sys_openat+0xce/0x140
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Link: https://lore.kernel.org/r/72ede0f6dab61f7f23df9ac7a70666e07ef314b0.1635055496.git.leonro@nvidia.com
Signed-off-by: Mark Zhang <markzhang@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/sa_query.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -760,8 +760,9 @@ static void ib_nl_set_path_rec_attrs(str
/* Construct the family header first */
header = skb_put(skb, NLMSG_ALIGN(sizeof(*header)));
- memcpy(header->device_name, dev_name(&query->port->agent->device->dev),
- LS_DEVICE_NAME_MAX);
+ strscpy_pad(header->device_name,
+ dev_name(&query->port->agent->device->dev),
+ LS_DEVICE_NAME_MAX);
header->port_num = query->port->port_num;
if ((comp_mask & IB_SA_PATH_REC_REVERSIBLE) &&
next prev parent reply other threads:[~2021-11-01 9:36 UTC|newest]
Thread overview: 99+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-01 9:16 [PATCH 5.10 00/77] 5.10.77-rc1 review Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 01/77] ARM: 9132/1: Fix __get_user_check failure with ARM KASAN images Greg Kroah-Hartman
2021-11-12 22:56 ` Florian Fainelli
2021-11-01 9:16 ` [PATCH 5.10 02/77] ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 03/77] ARM: 9134/1: remove duplicate memcpy() definition Greg Kroah-Hartman
2021-11-12 22:22 ` Pavel Machek
2021-11-01 9:16 ` [PATCH 5.10 04/77] ARM: 9138/1: fix link warning with XIP + frame-pointer Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 05/77] ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 06/77] ARM: 9141/1: only warn about XIP address when not compile testing Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 07/77] io_uring: dont take uring_lock during iowq cancel Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 08/77] powerpc/bpf: Fix BPF_MOD when imm == 1 Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 09/77] arm64: Avoid premature usercopy failure Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 10/77] ext4: fix possible UAF when remounting r/o a mmp-protected file system Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 11/77] usbnet: sanity check for maxpacket Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 12/77] usbnet: fix error return code in usbnet_probe() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 13/77] Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode" Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 14/77] pinctrl: amd: disable and mask interrupts on probe Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 15/77] ata: sata_mv: Fix the error handling of mv_chip_id() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 16/77] tipc: fix size validations for the MSG_CRYPTO type Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 17/77] nfc: port100: fix using -ERRNO as command type mask Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 18/77] Revert "net: mdiobus: Fix memory leak in __mdiobus_register" Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 19/77] net/tls: Fix flipped sign in tls_err_abort() calls Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 20/77] mmc: vub300: fix control-message timeouts Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 21/77] mmc: cqhci: clear HALT state after CQE enable Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 22/77] mmc: mediatek: Move cqhci init behind ungate clock Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 23/77] mmc: dw_mmc: exynos: fix the finding clock sample value Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 24/77] mmc: sdhci: Map more voltage level to SDHCI_POWER_330 Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 25/77] mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 26/77] ocfs2: fix race between searching chunks and release journal_head from buffer_head Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 27/77] nvme-tcp: fix H2CData PDU send accounting (again) Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 28/77] cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 29/77] cfg80211: fix management registrations locking Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 30/77] net: lan78xx: fix division by zero in send path Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 31/77] mm, thp: bail out early in collapse_file for writeback page Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 32/77] drm/ttm: fix memleak in ttm_transfered_destroy Greg Kroah-Hartman
2021-11-03 19:52 ` Sven Joachim
2021-11-03 20:29 ` [Nouveau] " Karol Herbst
2021-11-03 20:32 ` Karol Herbst
2021-11-03 20:47 ` Sven Joachim
2021-11-03 21:25 ` Karol Herbst
2021-11-04 7:39 ` Christian König
2021-11-04 8:44 ` Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 33/77] drm/amdgpu: fix out of bounds write Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 34/77] cgroup: Fix memory leak caused by missing cgroup_bpf_offline Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 35/77] riscv, bpf: Fix potential NULL dereference Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 36/77] tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 37/77] bpf: Fix potential race in tail call compatibility check Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 38/77] bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 39/77] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 40/77] IB/hfi1: Fix abba locking issue with sc_disable() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 41/77] nvmet-tcp: fix data digest pointer calculation Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 42/77] nvme-tcp: " Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 43/77] nvme-tcp: fix possible req->offset corruption Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 44/77] octeontx2-af: Display all enabled PF VF rsrc_alloc entries Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 45/77] RDMA/mlx5: Set user priority for DCT Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 46/77] arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 47/77] reset: brcmstb-rescal: fix incorrect polarity of status bit Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 48/77] regmap: Fix possible double-free in regcache_rbtree_exit() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 49/77] net: batman-adv: fix error handling Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 50/77] net-sysfs: initialize uid and gid before calling net_ns_get_ownership Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 51/77] cfg80211: correct bridge/4addr mode check Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 52/77] net: Prevent infinite while loop in skb_tx_hash() Greg Kroah-Hartman
2021-11-01 9:17 ` Greg Kroah-Hartman [this message]
2021-11-01 9:17 ` [PATCH 5.10 54/77] gpio: xgs-iproc: fix parsing of ngpios property Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 55/77] nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 56/77] mlxsw: pci: Recycle received packet upon allocation failure Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 57/77] net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 58/77] net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 59/77] net: nxp: lpc_eth.c: avoid hang when bringing interface down Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 60/77] net/tls: Fix flipped sign in async_wait.err assignment Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 61/77] phy: phy_ethtool_ksettings_get: Lock the phy for consistency Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 62/77] phy: phy_ethtool_ksettings_set: Move after phy_start_aneg Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 63/77] phy: phy_start_aneg: Add an unlocked version Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 64/77] phy: phy_ethtool_ksettings_set: Lock the PHY while changing settings Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 65/77] sctp: use init_tag from inithdr for ABORT chunk Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 66/77] sctp: fix the processing for INIT_ACK chunk Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 67/77] sctp: fix the processing for COOKIE_ECHO chunk Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 68/77] sctp: add vtag check in sctp_sf_violation Greg Kroah-Hartman
2021-11-02 14:12 ` Alexey Khoroshilov
2021-11-02 15:52 ` Greg Kroah-Hartman
2021-11-08 6:57 ` Greg Kroah-Hartman
2021-11-08 7:23 ` Alexey Khoroshilov
2021-11-08 7:43 ` Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 69/77] sctp: add vtag check in sctp_sf_do_8_5_1_E_sa Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 70/77] sctp: add vtag check in sctp_sf_ootb Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 71/77] lan743x: fix endianness when accessing descriptors Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 72/77] KVM: s390: clear kicked_mask before sleeping again Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 73/77] KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 74/77] scsi: ufs: ufs-exynos: Correct timeout value setting registers Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 75/77] riscv: fix misalgned trap vector base address Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 76/77] riscv: Fix asan-stack clang build Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 77/77] perf script: Check session->header.env.arch before using it Greg Kroah-Hartman
2021-11-01 12:34 ` [PATCH 5.10 00/77] 5.10.77-rc1 review Fox Chen
2021-11-01 21:21 ` Shuah Khan
2021-11-01 23:38 ` Guenter Roeck
2021-11-02 7:05 ` Naresh Kamboju
2021-11-02 12:12 ` Samuel Zou
2021-11-02 12:52 ` Sudip Mukherjee
2021-11-02 12:54 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211101082522.807183069@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@nvidia.com \
--cc=leonro@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=markzhang@nvidia.com \
--cc=mbloch@nvidia.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).