On Thu, Aug 08, 2019 at 11:15:38AM +0300, Leon Romanovsky wrote: > From: Yishai Hadas <yishaih@xxxxxxxxxxxx> > > Call to uverbs_close_fd() releases file pointer to 'ev_file' and > mlx5_ib_dev is going to be inaccessible. Cache pointer prior cleaning > resources to solve the KASAN warning below. > > BUG: KASAN: use-after-free in devx_async_event_close+0x391/0x480 [mlx5_ib] > Read of size 8 at addr ffff888301e3cec0 by task devx_direct_tes/4631 > CPU: 1 PID: 4631 Comm: devx_direct_tes Tainted: G OE 5.3.0-rc1-for-upstream-dbg-2019-07-26_01-19-56-93 #1 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014 > Call Trace: > dump_stack+0x9a/0xeb > print_address_description+0x1e2/0x400 > ? devx_async_event_close+0x391/0x480 [mlx5_ib] > __kasan_report+0x15c/0x1df > ? devx_async_event_close+0x391/0x480 [mlx5_ib] > kasan_report+0xe/0x20 > devx_async_event_close+0x391/0x480 [mlx5_ib] > __fput+0x26a/0x7b0 > task_work_run+0x10d/0x180 > exit_to_usermode_loop+0x137/0x160 > do_syscall_64+0x3c7/0x490 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x7f5df907d664 > Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f > 80 00 00 00 00 8b 05 6a cd 20 00 48 63 ff 85 c0 75 13 b8 > 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 f3 c3 66 90 > 48 83 ec 18 48 89 7c 24 08 e8 > RSP: 002b:00007ffd353cb958 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 > RAX: 0000000000000000 RBX: 000056017a88c348 RCX: 00007f5df907d664 > RDX: 00007f5df969d400 RSI: 00007f5de8f1ec90 RDI: 0000000000000006 > RBP: 00007f5df9681dc0 R08: 00007f5de8736410 R09: 000056017a9d2dd0 > R10: 000000000000000b R11: 0000000000000246 R12: 00007f5de899d7d0 > R13: 00007f5df96c4248 R14: 00007f5de8f1ecb0 R15: 000056017ae41308 > > Allocated by task 4631: > save_stack+0x19/0x80 > kasan_kmalloc.constprop.3+0xa0/0xd0 > alloc_uobj+0x71/0x230 [ib_uverbs] > alloc_begin_fd_uobject+0x2e/0xc0 [ib_uverbs] > rdma_alloc_begin_uobject+0x96/0x140 [ib_uverbs] > ib_uverbs_run_method+0xdf0/0x1940 [ib_uverbs] > ib_uverbs_cmd_verbs+0x57e/0xdb0 [ib_uverbs] > ib_uverbs_ioctl+0x177/0x260 [ib_uverbs] > do_vfs_ioctl+0x18f/0x1010 > ksys_ioctl+0x70/0x80 > __x64_sys_ioctl+0x6f/0xb0 > do_syscall_64+0x95/0x490 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > Freed by task 4631: > save_stack+0x19/0x80 > __kasan_slab_free+0x11d/0x160 > slab_free_freelist_hook+0x67/0x1a0 > kfree+0xb9/0x2a0 > uverbs_close_fd+0x118/0x1c0 [ib_uverbs] > devx_async_event_close+0x28a/0x480 [mlx5_ib] > __fput+0x26a/0x7b0 > task_work_run+0x10d/0x180 > exit_to_usermode_loop+0x137/0x160 > do_syscall_64+0x3c7/0x490 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > The buggy address belongs to the object at ffff888301e3cda8 > which belongs to the cache kmalloc-512 of size 512 > The buggy address is located 280 bytes inside of 512-byte region > [ffff888301e3cda8, ffff888301e3cfa8) > The buggy address belongs to the page: > page:ffffea000c078e00 refcount:1 mapcount:0 > mapping:ffff888352811300 index:0x0 compound_mapcount: 0 > flags: 0x2fffff80010200(slab|head) > raw: 002fffff80010200 ffffea000d152608 ffffea000c077808 ffff888352811300 > raw: 0000000000000000 0000000000250025 00000001ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > Memory state around the buggy address: > ffff888301e3cd80: fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb fb > ffff888301e3ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888301e3ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888301e3cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888301e3cf80: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc > Disabling lock debugging due to kernel taint > > Cc: <stable@xxxxxxxxxxxxxxx> # 5.2 > Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") > Signed-off-by: Yishai Hadas <yishaih@xxxxxxxxxxxx> > Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx> > drivers/infiniband/hw/mlx5/devx.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c > index 2d1b3d9609d9..af5bbb35c058 100644 > +++ b/drivers/infiniband/hw/mlx5/devx.c > @@ -2644,12 +2644,13 @@ static int devx_async_event_close(struct inode *inode, struct file *filp) > struct devx_async_event_file *ev_file = filp->private_data; This line is wrong, it should be struct devx_async_event_file *ev_file = container_of(struct devx_async_event_file, filp->private_data, uobj); It should get fixed in a followup, along with any other places like it. It is also a bit redundant to store the mlx5_ib_dev in the devx_async_event_file as uobj->ucontext->dev is the same pointer. Otherwise this patch is Ok Reviewed-by: Jason Gunthorpe <jgg@xxxxxxxxxxxx>