Re: use-after-free in debug_spin_lock_before invoked the rdma driver

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 7/28/2023 8:45 AM, Zheng Zhang wrote:
*External email: Use caution opening links or attachments*


Jason, Leon, Mark Zhang, Mark Bloch and  to whom it may concern:

Hello! We have found a bug in the Linux kernel version 6.2.0 by Syzkaller with our own templates. In the call trace it invoked the rdma driver, thus we think it may be different from the reported case invoked io_ring whose fix is also in the io_ring module.
Unfortunately, it doesn't generate a reproducer.

Attached is the report, log generated by syzkaller.
Please let me know if there is any additional information that I can provide to help debug this issue.
Thanks!
Best
zheng

Hi Zheng,

Thank you very much for reporting. Is it easy to reproduce? Can you please help test with this patch, thanks:

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 1ee87c3aaeab..76810aac1809 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3491,11 +3491,13 @@ static void addr_handler(int status, struct sockaddr *src_addr,
 		event.event = RDMA_CM_EVENT_ADDR_RESOLVED;

 	if (cma_cm_event_handler(id_priv, &event)) {
+		cma_id_put(id_priv);
 		destroy_id_handler_unlock(id_priv);
 		return;
 	}
 out:
 	mutex_unlock(&id_priv->handler_mutex);
+	cma_id_put(id_priv);
 }

 static int cma_resolve_loopback(struct rdma_id_private *id_priv)
@@ -4107,6 +4109,9 @@ int rdma_resolve_addr(struct rdma_cm_id *id, struct sockaddr *src_addr,
 				rdma_addr_cancel(&id->route.addr.dev_addr);
 			else
 				id_priv->used_resolve_ip = 1;
+
+			/* Balances with cma_id_put() in addr_handler */
+			cma_id_get(id_priv);
 			ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr,
 					      &id->route.addr.dev_addr,
 					      timeout_ms, addr_handler,




[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux