netdev - Re: [PATCH net v2] net/smc: fix potential panic dues to unprotected smc_llc_srv_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 16 Feb 2023 14:51:12 +0100
From:   Wenjia Zhang <wenjia@...ux.ibm.com>
To:     "D. Wythe" <alibuda@...ux.alibaba.com>, kgraul@...ux.ibm.com,
        jaka@...ux.ibm.com
Cc:     kuba@...nel.org, davem@...emloft.net, netdev@...r.kernel.org,
        linux-s390@...r.kernel.org, linux-rdma@...r.kernel.org
Subject: Re: [PATCH net v2] net/smc: fix potential panic dues to unprotected
 smc_llc_srv_add_link()



On 16.02.23 07:37, D. Wythe wrote:
> From: "D. Wythe" <alibuda@...ux.alibaba.com>
> 
> There is a certain chance to trigger the following panic:
> 
> PID: 5900   TASK: ffff88c1c8af4100  CPU: 1   COMMAND: "kworker/1:48"
>   #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7
>   #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a
>   #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60
>   #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7
>   #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715
>   #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654
>   #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62
>      [exception RIP: ib_alloc_mr+19]
>      RIP: ffffffffc0c9cce3  RSP: ffff9456c1cc7c38  RFLAGS: 00010202
>      RAX: 0000000000000000  RBX: 0000000000000002  RCX: 0000000000000004
>      RDX: 0000000000000010  RSI: 0000000000000000  RDI: 0000000000000000
>      RBP: ffff88c1ea281d00   R8: 000000020a34ffff   R9: ffff88c1350bbb20
>      R10: 0000000000000000  R11: 0000000000000001  R12: 0000000000000000
>      R13: 0000000000000010  R14: ffff88c1ab040a50  R15: ffff88c1ea281d00
>      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
>   #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc]
>   #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc]
>   #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]
> 
> The reason here is that when the server tries to create a second link,
> smc_llc_srv_add_link() has no protection and may add a new link to
> link group. This breaks the security environment protected by
> llc_conf_mutex.
> 
> Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server")
> Signed-off-by: D. Wythe <alibuda@...ux.alibaba.com>
> ---
> v2: rebase it with lastest net tree
> 
>   net/smc/af_smc.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index e12d4fa..d9413d4 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -1826,8 +1826,10 @@ static int smcr_serv_conf_first_link(struct smc_sock *smc)
>   	smc_llc_link_active(link);
>   	smcr_lgr_set_type(link->lgr, SMC_LGR_SINGLE);
>   
> +	mutex_lock(&link->lgr->llc_conf_mutex);
>   	/* initial contact - try to establish second link */
>   	smc_llc_srv_add_link(link, NULL);
> +	mutex_unlock(&link->lgr->llc_conf_mutex);
>   	return 0;
>   }
>   

Reviewed-by: Wenjia Zhang <wenjia@...ux.ibm.com>