linux-kernel - Re: [PATCH rdma-rc] RDMA/cma: Clear all multicast request fields

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Jan 2022 11:36:19 -0400
From:   Jason Gunthorpe <jgg@...dia.com>
To:     Leon Romanovsky <leon@...nel.org>
Cc:     linux-kernel@...r.kernel.org, linux-rdma@...r.kernel.org,
        syzbot+8fcbb77276d43cc8b693@...kaller.appspotmail.com
Subject: Re: [PATCH rdma-rc] RDMA/cma: Clear all multicast request fields

On Sun, Jan 09, 2022 at 02:22:04PM +0200, Leon Romanovsky wrote:
> On Thu, Jan 06, 2022 at 01:39:41PM -0400, Jason Gunthorpe wrote:
> > On Thu, Jan 06, 2022 at 03:15:07PM +0200, Leon Romanovsky wrote:
> > > From: Leon Romanovsky <leonro@...dia.com>
> > > 
> > > The ib->rec.qkey field is accessed without being initialized.
> > > Clear the ib_sa_multicast struct to fix the following syzkaller error/.
> > > 
> > > =====================================================
> > > BUG: KMSAN: uninit-value in cma_set_qkey drivers/infiniband/core/cma.c:510 [inline]
> > > BUG: KMSAN: uninit-value in cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570
> > >  cma_set_qkey drivers/infiniband/core/cma.c:510 [inline]
> > >  cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570
> > >  cma_iboe_join_multicast drivers/infiniband/core/cma.c:4782 [inline]
> > >  rdma_join_multicast+0x2b83/0x30a0 drivers/infiniband/core/cma.c:4814
> > >  ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479
> > >  ucma_join_multicast+0x1e3/0x250 drivers/infiniband/core/ucma.c:1546
> > >  ucma_write+0x639/0x6d0 drivers/infiniband/core/ucma.c:1732
> > >  vfs_write+0x8ce/0x2030 fs/read_write.c:588
> > >  ksys_write+0x28c/0x520 fs/read_write.c:643
> > >  __do_sys_write fs/read_write.c:655 [inline]
> > >  __se_sys_write fs/read_write.c:652 [inline]
> > >  __ia32_sys_write+0xdb/0x120 fs/read_write.c:652
> > >  do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
> > >  __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
> > >  do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
> > >  do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
> > >  entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
> > > 
> > > Local variable ib.i created at:
> > >  cma_iboe_join_multicast drivers/infiniband/core/cma.c:4737 [inline]
> > >  rdma_join_multicast+0x586/0x30a0 drivers/infiniband/core/cma.c:4814
> > >  ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479
> > > 
> > > CPU: 0 PID: 29874 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > > =====================================================
> > > 
> > > Fixes: b5de0c60cc30 ("RDMA/cma: Fix use after free race in roce multicast join")
> > > Reported-by: syzbot+8fcbb77276d43cc8b693@...kaller.appspotmail.com
> > > Signed-off-by: Leon Romanovsky <leonro@...dia.com>
> > >  drivers/infiniband/core/cma.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> > > index 69c9a12dd14e..9c53e1e7de50 100644
> > > +++ b/drivers/infiniband/core/cma.c
> > > @@ -4737,7 +4737,7 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv,
> > >  	int err = 0;
> > >  	struct sockaddr *addr = (struct sockaddr *)&mc->addr;
> > >  	struct net_device *ndev = NULL;
> > > -	struct ib_sa_multicast ib;
> > > +	struct ib_sa_multicast ib = {};
> > >  	enum ib_gid_type gid_type;
> > >  	bool send_only;
> > 
> > We shouldn't be able to join anything except a RDMA_PS_UDP to a
> > multicast in the first place:
> > 
> > 	if (id_priv->id.ps == RDMA_PS_UDP)
> > 		ib.rec.qkey = cpu_to_be32(RDMA_UDP_QKEY);
> > 
> > Multicast RC/etc is meaningless. So I guess it should be like this:
> 
> I don't know, I used 0 exactly like we have for cma_join_ib_multicast().
> 
> Where can I read about this PS limitation? I didn't find anything
> relevant in the IBTA spec.

It is a Linux thing

We should probably check the PS even earlier to prevent the IB side
from having the same issue.

multicast should never be used in any place that can omit a qkey,
IIRC..

Jason