linux-stable/drivers
Michael J. Ruhl b4d91aeb6e RDMA/netlink: OOPs in rdma_nl_rcv_msg() from misinterpreted flag
rdma_nl_rcv_msg() checks to see if it should use the .dump() callback
or the .doit() callback.  The check is done with this check:

if (flags & NLM_F_DUMP) ...

The NLM_F_DUMP flag is two bits (NLM_F_ROOT | NLM_F_MATCH).

When an RDMA_NL_LS message (response) is received, the bit used for
indicating an error is the same bit as NLM_F_ROOT.

NLM_F_ROOT == (0x100) == RDMA_NL_LS_F_ERR.

ibacm sends a response with the RDMA_NL_LS_F_ERR bit set if an error
occurs in the service.  The current code then misinterprets the
NLM_F_DUMP bit and trys to call the .dump() callback.

If the .dump() callback for the specified request is not available
(which is true for the RDMA_NL_LS messages) the following Oops occurs:

[ 4555.960256] BUG: unable to handle kernel NULL pointer dereference at
   (null)
[ 4555.969046] IP:           (null)
[ 4555.972664] PGD 10543f1067 P4D 10543f1067 PUD 1033f93067 PMD 0
[ 4555.979287] Oops: 0010 [#1] SMP
[ 4555.982809] Modules linked in: rpcrdma ib_isert iscsi_target_mod
target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_ucm ib_ucm
ib_uverbs ib_umad rdma_cm ib_cm iw_cm dm_mirror dm_region_hash dm_log dm_mod
dax sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass
crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel crypto_simd
glue_helper cryptd hfi1 rdmavt iTCO_wdt iTCO_vendor_support ib_core mei_me
lpc_ich pcspkr mei ioatdma sg shpchp i2c_i801 mfd_core wmi ipmi_si ipmi_devintf
ipmi_msghandler acpi_power_meter acpi_pad nfsd auth_rpcgss nfs_acl lockd grace
sunrpc ip_tables ext4 mbcache jbd2 sd_mod mgag200 drm_kms_helper syscopyarea
sysfillrect sysimgblt fb_sys_fops ttm igb ahci crc32c_intel ptp libahci
pps_core drm dca libata i2c_algo_bit i2c_core
[ 4556.061190] CPU: 54 PID: 9841 Comm: ibacm Tainted: G          I
4.14.0-rc2+ #6
[ 4556.069667] Hardware name: Intel Corporation S2600WT2/S2600WT2, BIOS
SE5C610.86B.01.01.0008.021120151325 02/11/2015
[ 4556.081339] task: ffff880855f42d00 task.stack: ffffc900246b4000
[ 4556.087967] RIP: 0010:          (null)
[ 4556.092166] RSP: 0018:ffffc900246b7bc8 EFLAGS: 00010246
[ 4556.098018] RAX: ffffffff81dbe9e0 RBX: ffff881058bb1000 RCX:
0000000000000000
[ 4556.105997] RDX: 0000000000001100 RSI: ffff881058bb1320 RDI:
ffff881056362000
[ 4556.113984] RBP: ffffc900246b7bf8 R08: 0000000000000ec0 R09:
0000000000001100
[ 4556.121971] R10: ffff8810573a5000 R11: 0000000000000000 R12:
ffff881056362000
[ 4556.129957] R13: 0000000000000ec0 R14: ffff881058bb1320 R15:
0000000000000ec0
[ 4556.137945] FS:  00007fe0ba5a38c0(0000) GS:ffff88105f080000(0000)
knlGS:0000000000000000
[ 4556.147000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4556.153433] CR2: 0000000000000000 CR3: 0000001056f5d003 CR4:
00000000001606e0
[ 4556.161419] Call Trace:
[ 4556.164167]  ? netlink_dump+0x12c/0x290
[ 4556.168468]  __netlink_dump_start+0x186/0x1f0
[ 4556.173357]  rdma_nl_rcv_msg+0x193/0x1b0 [ib_core]
[ 4556.178724]  rdma_nl_rcv+0xdc/0x130 [ib_core]
[ 4556.183604]  netlink_unicast+0x181/0x240
[ 4556.187998]  netlink_sendmsg+0x2c2/0x3b0
[ 4556.192392]  sock_sendmsg+0x38/0x50
[ 4556.196299]  SYSC_sendto+0x102/0x190
[ 4556.200308]  ? __audit_syscall_entry+0xaf/0x100
[ 4556.205387]  ? syscall_trace_enter+0x1d0/0x2b0
[ 4556.210366]  ? __audit_syscall_exit+0x209/0x290
[ 4556.215442]  SyS_sendto+0xe/0x10
[ 4556.219060]  do_syscall_64+0x67/0x1b0
[ 4556.223165]  entry_SYSCALL64_slow_path+0x25/0x25
[ 4556.228328] RIP: 0033:0x7fe0b9db2a63
[ 4556.232333] RSP: 002b:00007ffc55edc260 EFLAGS: 00000293 ORIG_RAX:
000000000000002c
[ 4556.240808] RAX: ffffffffffffffda RBX: 0000000000000010 RCX:
00007fe0b9db2a63
[ 4556.248796] RDX: 0000000000000010 RSI: 00007ffc55edc280 RDI:
000000000000000d
[ 4556.256782] RBP: 00007ffc55edc670 R08: 00007ffc55edc270 R09:
000000000000000c
[ 4556.265321] R10: 0000000000000000 R11: 0000000000000293 R12:
00007ffc55edc280
[ 4556.273846] R13: 000000000260b400 R14: 000000000000000d R15:
0000000000000001
[ 4556.282368] Code:  Bad RIP value.
[ 4556.286629] RIP:           (null) RSP: ffffc900246b7bc8
[ 4556.293013] CR2: 0000000000000000
[ 4556.297292] ---[ end trace 8d67abcfd10ec209 ]---
[ 4556.305465] Kernel panic - not syncing: Fatal exception
[ 4556.313786] Kernel Offset: disabled
[ 4556.321563] ---[ end Kernel panic - not syncing: Fatal exception
[ 4556.328960] ------------[ cut here ]------------

Special case RDMA_NL_LS response messages to call the appropriate
callback.

Additionally, make sure that the .dump() callback is not NULL
before calling it.

Fixes: 647c75ac59 ("RDMA/netlink: Convert LS to doit callback")
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Kaike Wan <kaike.wan@intel.com>
Reviewed-by: Alex Estrin <alex.estrin@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-10-25 14:54:43 -04:00
..
accessibility
acpi Merge branches 'acpi-pmic', 'acpi-bus', 'acpi-wdat' and 'acpi-properties' 2017-09-22 23:38:45 +02:00
amba
android ANDROID: binder: don't queue async transactions to thread. 2017-09-01 09:22:50 +02:00
ata Merge branch 'for-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2017-09-06 22:41:21 -07:00
atm
auxdisplay
base Power management fixes for v4.14-rc2 2017-09-22 17:28:59 -10:00
bcma
block The highlights include: 2017-09-12 20:03:53 -07:00
bluetooth
bus ARM: SoC driver updates for v4.14 2017-09-10 20:40:00 -07:00
cdrom
char Merge branch 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2017-09-24 11:34:28 -07:00
clk The diff is dominated by the Allwinner A10/A20 SoCs getting converted to 2017-09-13 11:04:14 -07:00
clocksource clocksource/integrator: Fix section mismatch warning 2017-09-18 09:37:33 +02:00
connector
cpufreq cpufreq: ti-cpufreq: Support additional am43xx platforms 2017-09-20 00:51:01 +02:00
cpuidle ARM: cpuidle: Avoid memleak if init fail 2017-09-19 23:10:51 +02:00
crypto crypto: caam - fix LS1021A support on ARMv7 multiplatform kernel 2017-09-20 17:42:42 +08:00
dax - Some request-based DM core and DM multipath fixes and cleanups 2017-09-14 13:43:16 -07:00
dca
devfreq
dio
dma dmaengine updates for 4.14-rc1 2017-09-07 14:03:05 -07:00
dma-buf
edac
eisa
extcon
firewire
firmware dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
fmc
fpga
fsi
gpio - New Drivers 2017-09-07 13:51:13 -07:00
gpu Merge tag 'exynos-drm-fixes-for-v4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes 2017-09-21 08:02:39 +10:00
hid media updates for v4.14-rc1 2017-09-07 12:53:14 -07:00
hsi
hv Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-09-07 09:25:15 -07:00
hwmon dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
hwspinlock
hwtracing
i2c i2c: i2c-stm32f7: add driver 2017-09-14 17:34:43 +02:00
ide Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
idle Power management updates for v4.14-rc1 2017-09-05 12:19:08 -07:00
iio - New Drivers 2017-09-07 13:51:13 -07:00
infiniband RDMA/netlink: OOPs in rdma_nl_rcv_msg() from misinterpreted flag 2017-10-25 14:54:43 -04:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2017-09-22 17:23:41 -10:00
iommu iommu/of: Remove PCI host bridge node check 2017-09-22 12:05:43 +02:00
ipack
irqchip irqchip.mips-gic: Fix shared interrupt mask writes 2017-09-19 19:44:07 +01:00
isdn isdn/i4l: fetch the ppp_write buffer in one shot 2017-09-20 16:01:36 -07:00
leds dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
lightnvm
macintosh powerpc/macintosh: constify wf_sensor_ops structures 2017-09-01 16:42:54 +10:00
mailbox Just behavorial changes to a controller driver: 2017-09-07 13:23:37 -07:00
mcb Char/Misc drivers for 4.14-rc1 2017-09-05 11:08:17 -07:00
md Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md 2017-09-19 08:39:32 -07:00
media Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:13:32 -07:00
memory ARM: SoC driver updates for v4.14 2017-09-10 20:40:00 -07:00
memstick
message
mfd dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
misc mm: treewide: remove GFP_TEMPORARY allocation flag 2017-09-13 18:53:16 -07:00
mmc mmc: cavium: Fix use-after-free in of_platform_device_destroy 2017-09-08 15:38:22 +02:00
mtd mtd: nand: remove unused blockmask variable 2017-09-18 14:51:02 +02:00
mux
net net: phy: Fix truncation of large IRQ numbers in phy_attached_print() 2017-09-21 20:35:17 -07:00
nfc
ntb
nubus
nvdimm libnvdimm, namespace: fix btt claim class crash 2017-09-18 17:29:01 -07:00
nvme nvme-pci: implement the HMB entry number and size limitations 2017-09-11 12:29:40 -04:00
nvmem
of dma-mapping updates for 4.14: 2017-09-12 13:30:06 -07:00
oprofile
parisc
parport Char/Misc drivers for 4.14-rc1 2017-09-05 11:08:17 -07:00
pci PCI: endpoint: Use correct "end of test" interrupt 2017-09-20 13:56:06 -05:00
pcmcia
perf drivers/perf: arm_pmu_acpi: Release memory obtained by kasprintf 2017-09-22 15:11:46 +01:00
phy Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
pinctrl pinctrl/amd: save pin registers over suspend/resume 2017-09-12 15:58:45 +02:00
platform dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
pnp dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
power power supply and reset changes for the v4.14 series 2017-09-09 14:44:39 -07:00
powercap
pps drivers/pps: use surrounding "if PPS" to remove numerous dependency checks 2017-09-08 18:26:51 -07:00
ps3
ptp
pwm pwm: Changes for v4.14-rc1 2017-09-11 13:04:32 -07:00
rapidio
ras
regulator - New Drivers 2017-09-07 13:51:13 -07:00
remoteproc rpmsg updates for v4.14 2017-09-09 14:34:38 -07:00
reset Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
rpmsg rpmsg: glink: initialize ret to zero to ensure error status check is correct 2017-09-04 10:52:30 -07:00
rtc RTC for 4.14 2017-09-13 10:56:00 -07:00
s390 s390/cio: recover from bad paths 2017-09-19 08:36:19 +02:00
sbus
scsi scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE 2017-09-15 15:16:49 -04:00
sfi
sh
sn
soc Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
spi ACPI updates for v4.14-rc1 2017-09-05 12:45:03 -07:00
spmi
ssb
staging Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:54:01 -07:00
target Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:13:32 -07:00
tc
tee
thermal Merge branches 'thermal-core', 'thermal-soc', 'thermal-intel' and 'const-thermal-zone-structure' into next 2017-09-08 11:20:04 +08:00
thunderbolt ACPI updates for v4.14-rc1 2017-09-05 12:45:03 -07:00
tty dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
uio
usb Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:13:32 -07:00
uwb
vfio vfio: platform: constify amba_id 2017-08-30 14:03:42 -06:00
vhost lib/interval_tree: fast overlap detection 2017-09-08 18:26:49 -07:00
video fbdev changes for v4.14: 2017-09-14 13:33:33 -07:00
virt
virtio SCSI misc on 20170907 2017-09-07 21:11:05 -07:00
vlynq
vme
w1 power supply and reset changes for the v4.14 series 2017-09-09 14:44:39 -07:00
watchdog Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
xen xen: Fixes for rc2 2017-09-22 06:40:47 -10:00
zorro
Kconfig
Makefile