linux-kernel - Re: [PATCH V5] rxe: Fix a sleep-in-atomic bug in post_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1497387712.7171.245.camel@redhat.com>
Date:   Tue, 13 Jun 2017 17:01:52 -0400
From:   Doug Ledford <dledford@...hat.com>
To:     Jia-Ju Bai <baijiaju1990@....com>, monis@...lanox.com,
        sean.hefty@...el.com, hal.rosenstock@...il.com,
        yuval.shaia@...cle.com
Cc:     linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH V5] rxe: Fix a sleep-in-atomic bug in post_one_send

On Mon, 2017-06-05 at 20:23 +0800, Jia-Ju Bai wrote:
> The driver may sleep under a spin lock, and the function call path
> is:
> post_one_send (acquire the lock by spin_lock_irqsave)
>   init_send_wqe
>     copy_from_user --> may sleep
> 
> There is no flow that makes "qp->is_user" true, and copy_from_user
> may
> cause bug when a non-user pointer is used. So the lines of
> copy_from_user
> and check of "qp->is_user" are removed.
> 
> Signed-off-by: Jia-Ju Bai <baijiaju1990@....com>

Thanks, applied.

-- 
Doug Ledford <dledford@...hat.com>
    GPG KeyID: B826A3330E572FDD
   
Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD