linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-16 07:35:14 +00:00

No description

Find a file

Jack Morgenstein b4f0fee7f7 IB/mad: Fix use-after-free in ib mad completion handling [ Upstream commit `770b7d96cf` ] We encountered a use-after-free bug when unloading the driver: [ 3562.116059] BUG: KASAN: use-after-free in ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.117233] Read of size 4 at addr ffff8882ca5aa868 by task kworker/u13:2/23862 [ 3562.118385] [ 3562.119519] CPU: 2 PID: 23862 Comm: kworker/u13:2 Tainted: G OE 5.1.0-for-upstream-dbg-2019-05-19_16-44-30-13 #1 [ 3562.121806] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014 [ 3562.123075] Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] [ 3562.124383] Call Trace: [ 3562.125640] dump_stack+0x9a/0xeb [ 3562.126911] print_address_description+0xe3/0x2e0 [ 3562.128223] ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.129545] __kasan_report+0x15c/0x1df [ 3562.130866] ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.132174] kasan_report+0xe/0x20 [ 3562.133514] ib_mad_post_receive_mads+0xddc/0xed0 [ib_core] [ 3562.134835] ? find_mad_agent+0xa00/0xa00 [ib_core] [ 3562.136158] ? qlist_free_all+0x51/0xb0 [ 3562.137498] ? mlx4_ib_sqp_comp_worker+0x1970/0x1970 [mlx4_ib] [ 3562.138833] ? quarantine_reduce+0x1fa/0x270 [ 3562.140171] ? kasan_unpoison_shadow+0x30/0x40 [ 3562.141522] ib_mad_recv_done+0xdf6/0x3000 [ib_core] [ 3562.142880] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 3562.144277] ? ib_mad_send_done+0x1810/0x1810 [ib_core] [ 3562.145649] ? mlx4_ib_destroy_cq+0x2a0/0x2a0 [mlx4_ib] [ 3562.147008] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 3562.148380] ? debug_object_deactivate+0x2b9/0x4a0 [ 3562.149814] __ib_process_cq+0xe2/0x1d0 [ib_core] [ 3562.151195] ib_cq_poll_work+0x45/0xf0 [ib_core] [ 3562.152577] process_one_work+0x90c/0x1860 [ 3562.153959] ? pwq_dec_nr_in_flight+0x320/0x320 [ 3562.155320] worker_thread+0x87/0xbb0 [ 3562.156687] ? __kthread_parkme+0xb6/0x180 [ 3562.158058] ? process_one_work+0x1860/0x1860 [ 3562.159429] kthread+0x320/0x3e0 [ 3562.161391] ? kthread_park+0x120/0x120 [ 3562.162744] ret_from_fork+0x24/0x30 ... [ 3562.187615] Freed by task 31682: [ 3562.188602] save_stack+0x19/0x80 [ 3562.189586] __kasan_slab_free+0x11d/0x160 [ 3562.190571] kfree+0xf5/0x2f0 [ 3562.191552] ib_mad_port_close+0x200/0x380 [ib_core] [ 3562.192538] ib_mad_remove_device+0xf0/0x230 [ib_core] [ 3562.193538] remove_client_context+0xa6/0xe0 [ib_core] [ 3562.194514] disable_device+0x14e/0x260 [ib_core] [ 3562.195488] __ib_unregister_device+0x79/0x150 [ib_core] [ 3562.196462] ib_unregister_device+0x21/0x30 [ib_core] [ 3562.197439] mlx4_ib_remove+0x162/0x690 [mlx4_ib] [ 3562.198408] mlx4_remove_device+0x204/0x2c0 [mlx4_core] [ 3562.199381] mlx4_unregister_interface+0x49/0x1d0 [mlx4_core] [ 3562.200356] mlx4_ib_cleanup+0xc/0x1d [mlx4_ib] [ 3562.201329] __x64_sys_delete_module+0x2d2/0x400 [ 3562.202288] do_syscall_64+0x95/0x470 [ 3562.203277] entry_SYSCALL_64_after_hwframe+0x49/0xbe The problem was that the MAD PD was deallocated before the MAD CQ. There was completion work pending for the CQ when the PD got deallocated. When the mad completion handling reached procedure ib_mad_post_receive_mads(), we got a use-after-free bug in the following line of code in that procedure: sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey; (the pd pointer in the above line is no longer valid, because the pd has been deallocated). We fix this by allocating the PD before the CQ in procedure ib_mad_port_open(), and deallocating the PD after freeing the CQ in procedure ib_mad_port_close(). Since the CQ completion work queue is flushed during ib_free_cq(), no completions will be pending for that CQ when the PD is later deallocated. Note that freeing the CQ before deallocating the PD is the practice in the ULPs. Fixes: `4be90bc60d` ("IB/mad: Remove ib_get_dma_mr calls") Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Link: https://lore.kernel.org/r/20190801121449.24973-1-leon@kernel.org Signed-off-by: Doug Ledford <dledford@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-08-25 10:47:57 +02:00
arch	arm64/mm: fix variable 'pud' set but not used	2019-08-25 10:47:56 +02:00
block	block, scsi: Change the preempt-only flag into a counter	2019-08-04 09:30:57 +02:00
certs	export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR()	2018-08-22 23:21:44 +09:00
crypto	crypto: chacha20poly1305 - fix atomic sleep when using async algorithm	2019-07-26 09:14:19 +02:00
Documentation	Documentation: Add swapgs description to the Spectre v1 documentation	2019-08-06 19:06:58 +02:00
drivers	IB/mad: Fix use-after-free in ib mad completion handling	2019-08-25 10:47:57 +02:00
firmware	kbuild: remove all dummy assignments to obj-	2017-11-18 11:46:06 +09:00
fs	Btrfs: fix deadlock between fiemap and transaction commits	2019-08-25 10:47:54 +02:00
include	KVM: Fix leak vCPU's VMCS value into other pCPU	2019-08-16 10:12:53 +02:00
init	initramfs: free initrd memory if opening /initrd.image fails	2019-06-15 11:54:01 +02:00
ipc	ipc/mqueue.c: only perform resource calculation if user valid	2019-08-06 19:06:52 +02:00
kernel	cpufreq: schedutil: Don't skip freq update when limits change	2019-08-25 10:47:46 +02:00
lib	test_firmware: fix a memory leak bug	2019-08-16 10:12:49 +02:00
LICENSES	LICENSES: Remove CC-BY-SA-4.0 license text	2018-10-18 11:28:50 +02:00
mm	mm/usercopy: use memory range to be accessed for wraparound check	2019-08-25 10:47:44 +02:00
net	netfilter: ebtables: also count base chain policies	2019-08-25 10:47:50 +02:00
samples	samples, bpf: suppress compiler warning	2019-07-14 08:11:04 +02:00
scripts	kbuild: Check for unknown options with cc-option usage in Kconfig and clang	2019-08-25 10:47:56 +02:00
security	selinux: fix memory leak in policydb_init()	2019-08-06 19:06:54 +02:00
sound	ALSA: hda - Let all conexant codec enter D3 when rebooting	2019-08-25 10:47:48 +02:00
tools	perf header: Fix use of unitialized value warning	2019-08-25 10:47:53 +02:00
usr	initramfs: move gen_initramfs_list.sh from scripts/ to usr/	2018-08-22 23:21:44 +09:00
virt	KVM: Fix leak vCPU's VMCS value into other pCPU	2019-08-16 10:12:53 +02:00
.clang-format	clang-format: Set IndentWrappedFunctionNames false	2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
.mailmap	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	9p: remove Ron Minnich from MAINTAINERS	2018-08-17 16:20:26 -07:00
Kbuild	Kbuild updates for v4.15	2017-11-17 17:45:29 -08:00
Kconfig	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
MAINTAINERS	platform/x86: Add Intel AtomISP2 dummy / power-management driver	2019-04-20 09:16:02 +02:00
Makefile	Linux 4.19.67	2019-08-16 10:12:54 +02:00
README	Docs: Added a pointer to the formatted docs to README	2018-03-21 09:02:53 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.