* [PATCH net] RDMA/core: fix UAF in ib_get_eth_speed
@ 2024-03-28 11:22 Denis Kirjanov
2024-03-28 11:24 ` Denis Kirjanov
2024-03-28 11:24 ` Eric Dumazet
0 siblings, 2 replies; 3+ messages in thread
From: Denis Kirjanov @ 2024-03-28 11:22 UTC (permalink / raw)
To: netdev; +Cc: edumazet, jgg, leon, Denis Kirjanov, syzbot+5fe14f2ff4ccbace9a26
call to ib_device_get_netdev from ib_get_eth_speed
may lead to a race condition while accessing a netdevice
instance since we don't hold the rtnl lock while checking
the registration state:
if (res && res->reg_state != NETREG_REGISTERED) {
Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
Fixes: d41861942fc55 ("IB/core: Add generic function to extract IB speed from netdev")
Signed-off-by: Denis Kirjanov <dkirjanov@suse.de>
---
drivers/infiniband/core/verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 94a7f3b0c71c..aa4f642e7de9 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1976,11 +1976,11 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
if (rdma_port_get_link_layer(dev, port_num) != IB_LINK_LAYER_ETHERNET)
return -EINVAL;
+ rtnl_lock();
netdev = ib_device_get_netdev(dev, port_num);
if (!netdev)
return -ENODEV;
- rtnl_lock();
rc = __ethtool_get_link_ksettings(netdev, &lksettings);
rtnl_unlock();
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] RDMA/core: fix UAF in ib_get_eth_speed
2024-03-28 11:22 [PATCH net] RDMA/core: fix UAF in ib_get_eth_speed Denis Kirjanov
@ 2024-03-28 11:24 ` Denis Kirjanov
2024-03-28 11:24 ` Eric Dumazet
1 sibling, 0 replies; 3+ messages in thread
From: Denis Kirjanov @ 2024-03-28 11:24 UTC (permalink / raw)
To: Denis Kirjanov, netdev; +Cc: edumazet, jgg, leon, syzbot+5fe14f2ff4ccbace9a26
On 3/28/24 14:22, Denis Kirjanov wrote:
> call to ib_device_get_netdev from ib_get_eth_speed
> may lead to a race condition while accessing a netdevice
> instance since we don't hold the rtnl lock while checking
> the registration state:
> if (res && res->reg_state != NETREG_REGISTERED) {
>
> Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
> Fixes: d41861942fc55 ("IB/core: Add generic function to extract IB speed from netdev")
Please ignore, there is an issue on error path
> Signed-off-by: Denis Kirjanov <dkirjanov@suse.de>
> ---
> drivers/infiniband/core/verbs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
> index 94a7f3b0c71c..aa4f642e7de9 100644
> --- a/drivers/infiniband/core/verbs.c
> +++ b/drivers/infiniband/core/verbs.c
> @@ -1976,11 +1976,11 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
> if (rdma_port_get_link_layer(dev, port_num) != IB_LINK_LAYER_ETHERNET)
> return -EINVAL;
>
> + rtnl_lock();
> netdev = ib_device_get_netdev(dev, port_num);
> if (!netdev)
> return -ENODEV;
>
> - rtnl_lock();
> rc = __ethtool_get_link_ksettings(netdev, &lksettings);
> rtnl_unlock();
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] RDMA/core: fix UAF in ib_get_eth_speed
2024-03-28 11:22 [PATCH net] RDMA/core: fix UAF in ib_get_eth_speed Denis Kirjanov
2024-03-28 11:24 ` Denis Kirjanov
@ 2024-03-28 11:24 ` Eric Dumazet
1 sibling, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2024-03-28 11:24 UTC (permalink / raw)
To: Denis Kirjanov
Cc: netdev, jgg, leon, Denis Kirjanov, syzbot+5fe14f2ff4ccbace9a26
On Thu, Mar 28, 2024 at 12:23 PM Denis Kirjanov <kirjanov@gmail.com> wrote:
>
> call to ib_device_get_netdev from ib_get_eth_speed
> may lead to a race condition while accessing a netdevice
> instance since we don't hold the rtnl lock while checking
> the registration state:
> if (res && res->reg_state != NETREG_REGISTERED) {
>
> Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
> Fixes: d41861942fc55 ("IB/core: Add generic function to extract IB speed from netdev")
> Signed-off-by: Denis Kirjanov <dkirjanov@suse.de>
> ---
> drivers/infiniband/core/verbs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
> index 94a7f3b0c71c..aa4f642e7de9 100644
> --- a/drivers/infiniband/core/verbs.c
> +++ b/drivers/infiniband/core/verbs.c
> @@ -1976,11 +1976,11 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
> if (rdma_port_get_link_layer(dev, port_num) != IB_LINK_LAYER_ETHERNET)
> return -EINVAL;
>
> + rtnl_lock();
> netdev = ib_device_get_netdev(dev, port_num);
> if (!netdev)
This can not be right, we could return -ENODEV whild rtnl is kept locked.
> return -ENODEV;
>
> - rtnl_lock();
> rc = __ethtool_get_link_ksettings(netdev, &lksettings);
> rtnl_unlock();
>
> --
> 2.30.2
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-03-28 11:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-28 11:22 [PATCH net] RDMA/core: fix UAF in ib_get_eth_speed Denis Kirjanov
2024-03-28 11:24 ` Denis Kirjanov
2024-03-28 11:24 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox