RE: [PATCH rdma-rc v1] RDMA/ucma: Fix access to non-initialized CM_ID object

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> From: Leon Romanovsky <leonro@xxxxxxxxxxxx>
> 
> The attempt to join multicast group without ensuring that CMA device
> exists will lead to the following crash reported by syzkaller.
> 
> [   64.076794] BUG: KASAN: null-ptr-deref in
> rdma_join_multicast+0x26e/0x12c0
> [   64.076797] Read of size 8 at addr 00000000000000b0 by task
> join/691
> [   64.076797]
> [   64.076800] CPU: 1 PID: 691 Comm: join Not tainted 4.16.0-rc1-
> 00219-gb97853b65b93 #23
> [   64.076802] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-proj4
> [   64.076803] Call Trace:
> [   64.076809]  dump_stack+0x5c/0x77
> [   64.076817]  kasan_report+0x163/0x380
> [   64.085859]  ? rdma_join_multicast+0x26e/0x12c0
> [   64.086634]  rdma_join_multicast+0x26e/0x12c0
> [   64.087370]  ? rdma_disconnect+0xf0/0xf0
> [   64.088579]  ? __radix_tree_replace+0xc3/0x110
> [   64.089132]  ? node_tag_clear+0x81/0xb0
> [   64.089606]  ? idr_alloc_u32+0x12e/0x1a0
> [   64.090517]  ? __fprop_inc_percpu_max+0x150/0x150
> [   64.091768]  ? tracing_record_taskinfo+0x10/0xc0
> [   64.092340]  ? idr_alloc+0x76/0xc0
> [   64.092951]  ? idr_alloc_u32+0x1a0/0x1a0
> [   64.093632]  ? ucma_process_join+0x23d/0x460
> [   64.094510]  ucma_process_join+0x23d/0x460
> [   64.095199]  ? ucma_migrate_id+0x440/0x440
> [   64.095696]  ? futex_wake+0x10b/0x2a0
> [   64.096159]  ucma_join_multicast+0x88/0xe0
> [   64.096660]  ? ucma_process_join+0x460/0x460
> [   64.097540]  ? _copy_from_user+0x5e/0x90
> [   64.098017]  ucma_write+0x174/0x1f0
> [   64.098640]  ? ucma_resolve_route+0xf0/0xf0
> [   64.099343]  ? rb_erase_cached+0x6c7/0x7f0
> [   64.099839]  __vfs_write+0xc4/0x350
> [   64.100622]  ? perf_syscall_enter+0xe4/0x5f0
> [   64.101335]  ? kernel_read+0xa0/0xa0
> [   64.103525]  ? perf_sched_cb_inc+0xc0/0xc0
> [   64.105510]  ? syscall_exit_register+0x2a0/0x2a0
> [   64.107359]  ? __switch_to+0x351/0x640
> [   64.109285]  ? fsnotify+0x899/0x8f0
> [   64.111610]  ? fsnotify_unmount_inodes+0x170/0x170
> [   64.113876]  ? __fsnotify_update_child_dentry_flags+0x30/0x30
> [   64.115813]  ? ring_buffer_record_is_on+0xd/0x20
> [   64.117824]  ? __fget+0xa8/0xf0
> [   64.119869]  vfs_write+0xf7/0x280
> [   64.122001]  SyS_write+0xa1/0x120
> [   64.124213]  ? SyS_read+0x120/0x120
> [   64.126644]  ? SyS_read+0x120/0x120
> [   64.128563]  do_syscall_64+0xeb/0x250
> [   64.130732]  entry_SYSCALL_64_after_hwframe+0x21/0x86
> [   64.132984] RIP: 0033:0x7f5c994ade99
> [   64.135699] RSP: 002b:00007f5c99b97d98 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000001
> [   64.138740] RAX: ffffffffffffffda RBX: 00000000200001e4 RCX:
> 00007f5c994ade99
> [   64.141056] RDX: 00000000000000a0 RSI: 00000000200001c0 RDI:
> 0000000000000015
> [   64.143536] RBP: 00007f5c99b97ec0 R08: 0000000000000000 R09:
> 0000000000000000
> [   64.146017] R10: 0000000000000000 R11: 0000000000000246 R12:
> 00007f5c99b97fc0
> [   64.148608] R13: 0000000000000000 R14: 00007fff660e1c40 R15:
> 00007f5c99b989c0
> [   64.151060]
> [   64.153703] Disabling lock debugging due to kernel taint
> [   64.156032] BUG: unable to handle kernel NULL pointer dereference
> at 00000000000000b0
> [   64.159066] IP: rdma_join_multicast+0x26e/0x12c0
> [   64.161451] PGD 80000001d0298067 P4D 80000001d0298067 PUD
> 1dea39067 PMD 0
> [   64.164442] Oops: 0000 [#1] SMP KASAN PTI
> [   64.166817] CPU: 1 PID: 691 Comm: join Tainted: G    B 4.16.0-
> rc1-00219-gb97853b65b93 #23
> [   64.170004] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-proj4
> [   64.174985] RIP: 0010:rdma_join_multicast+0x26e/0x12c0
> [   64.177246] RSP: 0018:ffff8801c8207860 EFLAGS: 00010282
> [   64.179901] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
> ffffffff94789522
> [   64.183344] RDX: 1ffffffff2d50fa5 RSI: 0000000000000297 RDI:
> 0000000000000297
> [   64.186237] RBP: ffff8801c8207a50 R08: 0000000000000000 R09:
> ffffed0039040ea7
> [   64.189328] R10: 0000000000000001 R11: ffffed0039040ea6 R12:
> 0000000000000000
> [   64.192634] R13: 0000000000000000 R14: ffff8801e2022800 R15:
> ffff8801d4ac2400
> [   64.196105] FS:  00007f5c99b98700(0000) GS:ffff8801e5d00000(0000)
> knlGS:0000000000000000
> [   64.199211] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   64.202046] CR2: 00000000000000b0 CR3: 00000001d1c48004 CR4:
> 00000000003606a0
> [   64.205032] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> 0000000000000000
> [   64.208221] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> 0000000000000400
> [   64.211554] Call Trace:
> [   64.213464]  ? rdma_disconnect+0xf0/0xf0
> [   64.216124]  ? __radix_tree_replace+0xc3/0x110
> [   64.219337]  ? node_tag_clear+0x81/0xb0
> [   64.222140]  ? idr_alloc_u32+0x12e/0x1a0
> [   64.224422]  ? __fprop_inc_percpu_max+0x150/0x150
> [   64.226588]  ? tracing_record_taskinfo+0x10/0xc0
> [   64.229763]  ? idr_alloc+0x76/0xc0
> [   64.232186]  ? idr_alloc_u32+0x1a0/0x1a0
> [   64.234505]  ? ucma_process_join+0x23d/0x460
> [   64.237024]  ucma_process_join+0x23d/0x460
> [   64.240076]  ? ucma_migrate_id+0x440/0x440
> [   64.243284]  ? futex_wake+0x10b/0x2a0
> [   64.245302]  ucma_join_multicast+0x88/0xe0
> [   64.247783]  ? ucma_process_join+0x460/0x460
> [   64.250841]  ? _copy_from_user+0x5e/0x90
> [   64.253878]  ucma_write+0x174/0x1f0
> [   64.257008]  ? ucma_resolve_route+0xf0/0xf0
> [   64.259877]  ? rb_erase_cached+0x6c7/0x7f0
> [   64.262746]  __vfs_write+0xc4/0x350
> [   64.265537]  ? perf_syscall_enter+0xe4/0x5f0
> [   64.267792]  ? kernel_read+0xa0/0xa0
> [   64.270358]  ? perf_sched_cb_inc+0xc0/0xc0
> [   64.272575]  ? syscall_exit_register+0x2a0/0x2a0
> [   64.275367]  ? __switch_to+0x351/0x640
> [   64.277700]  ? fsnotify+0x899/0x8f0
> [   64.280530]  ? fsnotify_unmount_inodes+0x170/0x170
> [   64.283156]  ? __fsnotify_update_child_dentry_flags+0x30/0x30
> [   64.286182]  ? ring_buffer_record_is_on+0xd/0x20
> [   64.288749]  ? __fget+0xa8/0xf0
> [   64.291136]  vfs_write+0xf7/0x280
> [   64.292972]  SyS_write+0xa1/0x120
> [   64.294965]  ? SyS_read+0x120/0x120
> [   64.297474]  ? SyS_read+0x120/0x120
> [   64.299751]  do_syscall_64+0xeb/0x250
> [   64.301826]  entry_SYSCALL_64_after_hwframe+0x21/0x86
> [   64.304352] RIP: 0033:0x7f5c994ade99
> [   64.306711] RSP: 002b:00007f5c99b97d98 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000001
> [   64.309577] RAX: ffffffffffffffda RBX: 00000000200001e4 RCX:
> 00007f5c994ade99
> [   64.312334] RDX: 00000000000000a0 RSI: 00000000200001c0 RDI:
> 0000000000000015
> [   64.315783] RBP: 00007f5c99b97ec0 R08: 0000000000000000 R09:
> 0000000000000000
> [   64.318365] R10: 0000000000000000 R11: 0000000000000246 R12:
> 00007f5c99b97fc0
> [   64.320980] R13: 0000000000000000 R14: 00007fff660e1c40 R15:
> 00007f5c99b989c0
> [   64.323515] Code: e8 e8 79 08 ff 4c 89 ff 45 0f b6 a7 b8 01 00 00
> e8 68 7c 08 ff 49 8b 1f 4d 89 e5 49 c1 e4 04 48 8
> [   64.330753] RIP: rdma_join_multicast+0x26e/0x12c0 RSP:
> ffff8801c8207860
> [   64.332979] CR2: 00000000000000b0
> [   64.335550] ---[ end trace 0c00c17a408849c1 ]---
> 
> Reported-by: <syzbot+e6aba77967bd72cbc9d6@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication
> support")
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>

Reviewed-by: Sean Hefty <sean.hefty@xxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux