Patch "IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ib-mlx5-fix-init-stage-error-handling-to-avoid-doubl.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f97b407f5f11c3e82e2307837dca27649dc2b6fb
Author: George Kennedy <george.kennedy@xxxxxxxxxx>
Date:   Tue Oct 24 13:01:58 2023 -0500

    IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
    
    [ Upstream commit 2ef422f063b74adcc4a4a9004b0a87bb55e0a836 ]
    
    In the unlikely event that workqueue allocation fails and returns NULL in
    mlx5_mkey_cache_init(), delete the call to
    mlx5r_umr_resource_cleanup() (which frees the QP) in
    mlx5_ib_stage_post_ib_reg_umr_init().  This will avoid attempted double
    free of the same QP when __mlx5_ib_add() does its cleanup.
    
    Resolves a splat:
    
       Syzkaller reported a UAF in ib_destroy_qp_user
    
       workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR
       infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642):
       failed to create work queue
       infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642):
       mr cache init failed -12
       ==================================================================
       BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)
       Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642
    
       Call Trace:
       <TASK>
       kasan_report (mm/kasan/report.c:590)
       ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073)
       mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)
       __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178)
       mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)
       ...
       </TASK>
    
       Allocated by task 1642:
       __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026
       mm/slab_common.c:1039)
       create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720
       ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209)
       ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347)
       mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164)
       mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070)
       __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)
       mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)
       ...
    
       Freed by task 1642:
       __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822)
       ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112)
       mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)
       mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076
       drivers/infiniband/hw/mlx5/main.c:4065)
       __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168)
       mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402)
       ...
    
    Fixes: 04876c12c19e ("RDMA/mlx5: Move init and cleanup of UMR to umr.c")
    Link: https://lore.kernel.org/r/1698170518-4006-1-git-send-email-george.kennedy@xxxxxxxxxx
    Suggested-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: George Kennedy <george.kennedy@xxxxxxxxxx>
    Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 555629b798b95..5d963abb7e609 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -4071,10 +4071,8 @@ static int mlx5_ib_stage_post_ib_reg_umr_init(struct mlx5_ib_dev *dev)
 		return ret;
 
 	ret = mlx5_mkey_cache_init(dev);
-	if (ret) {
+	if (ret)
 		mlx5_ib_warn(dev, "mr cache init failed %d\n", ret);
-		mlx5r_umr_resource_cleanup(dev);
-	}
 	return ret;
 }
 



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux