* [PATCH net v2] net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
@ 2023-02-16 6:37 D. Wythe
2023-02-16 9:39 ` Larysa Zaremba
2023-02-16 13:51 ` Wenjia Zhang
0 siblings, 2 replies; 3+ messages in thread
From: D. Wythe @ 2023-02-16 6:37 UTC (permalink / raw)
To: kgraul, wenjia, jaka; +Cc: kuba, davem, netdev, linux-s390, linux-rdma
From: "D. Wythe" <alibuda@linux.alibaba.com>
There is a certain chance to trigger the following panic:
PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48"
#0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7
#1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a
#2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60
#3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7
#4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715
#5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654
#6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62
[exception RIP: ib_alloc_mr+19]
RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004
RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc]
#8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc]
#9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]
The reason here is that when the server tries to create a second link,
smc_llc_srv_add_link() has no protection and may add a new link to
link group. This breaks the security environment protected by
llc_conf_mutex.
Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
---
v2: rebase it with lastest net tree
net/smc/af_smc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index e12d4fa..d9413d4 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1826,8 +1826,10 @@ static int smcr_serv_conf_first_link(struct smc_sock *smc)
smc_llc_link_active(link);
smcr_lgr_set_type(link->lgr, SMC_LGR_SINGLE);
+ mutex_lock(&link->lgr->llc_conf_mutex);
/* initial contact - try to establish second link */
smc_llc_srv_add_link(link, NULL);
+ mutex_unlock(&link->lgr->llc_conf_mutex);
return 0;
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net v2] net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
2023-02-16 6:37 [PATCH net v2] net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() D. Wythe
@ 2023-02-16 9:39 ` Larysa Zaremba
2023-02-16 13:51 ` Wenjia Zhang
1 sibling, 0 replies; 3+ messages in thread
From: Larysa Zaremba @ 2023-02-16 9:39 UTC (permalink / raw)
To: D. Wythe
Cc: kgraul, wenjia, jaka, kuba, davem, netdev, linux-s390, linux-rdma
On Thu, Feb 16, 2023 at 02:37:36PM +0800, D. Wythe wrote:
> From: "D. Wythe" <alibuda@linux.alibaba.com>
>
> There is a certain chance to trigger the following panic:
>
> PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48"
> #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7
> #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a
> #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60
> #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7
> #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715
> #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654
> #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62
> [exception RIP: ib_alloc_mr+19]
> RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202
> RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004
> RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20
> R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
> R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00
> ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
> #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc]
> #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc]
> #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]
>
> The reason here is that when the server tries to create a second link,
> smc_llc_srv_add_link() has no protection and may add a new link to
> link group. This breaks the security environment protected by
> llc_conf_mutex.
>
> Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server")
> Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
> ---
> v2: rebase it with lastest net tree
>
> net/smc/af_smc.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index e12d4fa..d9413d4 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -1826,8 +1826,10 @@ static int smcr_serv_conf_first_link(struct smc_sock *smc)
> smc_llc_link_active(link);
> smcr_lgr_set_type(link->lgr, SMC_LGR_SINGLE);
>
> + mutex_lock(&link->lgr->llc_conf_mutex);
> /* initial contact - try to establish second link */
> smc_llc_srv_add_link(link, NULL);
> + mutex_unlock(&link->lgr->llc_conf_mutex);
> return 0;
> }
>
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net v2] net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
2023-02-16 6:37 [PATCH net v2] net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() D. Wythe
2023-02-16 9:39 ` Larysa Zaremba
@ 2023-02-16 13:51 ` Wenjia Zhang
1 sibling, 0 replies; 3+ messages in thread
From: Wenjia Zhang @ 2023-02-16 13:51 UTC (permalink / raw)
To: D. Wythe, kgraul, jaka; +Cc: kuba, davem, netdev, linux-s390, linux-rdma
On 16.02.23 07:37, D. Wythe wrote:
> From: "D. Wythe" <alibuda@linux.alibaba.com>
>
> There is a certain chance to trigger the following panic:
>
> PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48"
> #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7
> #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a
> #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60
> #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7
> #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715
> #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654
> #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62
> [exception RIP: ib_alloc_mr+19]
> RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202
> RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004
> RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20
> R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
> R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00
> ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
> #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc]
> #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc]
> #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]
>
> The reason here is that when the server tries to create a second link,
> smc_llc_srv_add_link() has no protection and may add a new link to
> link group. This breaks the security environment protected by
> llc_conf_mutex.
>
> Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server")
> Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
> ---
> v2: rebase it with lastest net tree
>
> net/smc/af_smc.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index e12d4fa..d9413d4 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -1826,8 +1826,10 @@ static int smcr_serv_conf_first_link(struct smc_sock *smc)
> smc_llc_link_active(link);
> smcr_lgr_set_type(link->lgr, SMC_LGR_SINGLE);
>
> + mutex_lock(&link->lgr->llc_conf_mutex);
> /* initial contact - try to establish second link */
> smc_llc_srv_add_link(link, NULL);
> + mutex_unlock(&link->lgr->llc_conf_mutex);
> return 0;
> }
>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-02-16 13:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-16 6:37 [PATCH net v2] net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() D. Wythe
2023-02-16 9:39 ` Larysa Zaremba
2023-02-16 13:51 ` Wenjia Zhang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).