linux-kernel - Re: [PATCH for-rc] RDMA/srpt: Fix UAF when srpt_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240801113055.GH4209@unreal>
Date: Thu, 1 Aug 2024 14:30:55 +0300
From: Leon Romanovsky <leon@...nel.org>
To: Junxian Huang <huangjunxian6@...ilicon.com>
Cc: jgg@...pe.ca, bvanassche@....org, nab@...ingtidesystems.com,
	linux-rdma@...r.kernel.org, linuxarm@...wei.com,
	linux-kernel@...r.kernel.org, target-devel@...r.kernel.org
Subject: Re: [PATCH for-rc] RDMA/srpt: Fix UAF when srpt_add_one() failed

On Thu, Aug 01, 2024 at 07:02:41PM +0800, Junxian Huang wrote:
> 
> 
> On 2024/8/1 18:37, Leon Romanovsky wrote:
> > On Thu, Aug 01, 2024 at 03:44:15PM +0800, Junxian Huang wrote:
> >> Currently cancel_work_sync() is not called when srpt_refresh_port()
> >> failed in srpt_add_one(). There is a probability that sdev has been
> >> freed while the previously initiated sport->work is still running,
> >> leading to a UAF as the log below:
> >>
> >> [  T880] ib_srpt MAD registration failed for hns_1-1.
> >> [  T880] ib_srpt srpt_add_one(hns_1) failed.
> >> [  T376] Unable to handle kernel paging request at virtual address 0000000000010008
> >> ...
> >> [  T376] Workqueue: events srpt_refresh_port_work [ib_srpt]
> >> ...
> >> [  T376] Call trace:
> >> [  T376]  srpt_refresh_port+0x94/0x264 [ib_srpt]
> >> [  T376]  srpt_refresh_port_work+0x1c/0x2c [ib_srpt]
> >> [  T376]  process_one_work+0x1d8/0x4cc
> >> [  T376]  worker_thread+0x158/0x410
> >> [  T376]  kthread+0x108/0x13c
> >> [  T376]  ret_from_fork+0x10/0x18
> >>
> >> Add cancel_work_sync() to the exception branch to fix this UAF.
> >>
> >> Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
> >> Signed-off-by: Junxian Huang <huangjunxian6@...ilicon.com>
> >> ---
> >>  drivers/infiniband/ulp/srpt/ib_srpt.c | 5 +++--
> >>  1 file changed, 3 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> >> index 9632afbd727b..244e5c115bf7 100644
> >> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> >> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> >> @@ -3148,8 +3148,8 @@ static int srpt_add_one(struct ib_device *device)
> >>  {
> >>  	struct srpt_device *sdev;
> >>  	struct srpt_port *sport;
> >> +	u32 i, j;
> >>  	int ret;
> >> -	u32 i;
> >>  
> >>  	pr_debug("device = %p\n", device);
> >>  
> >> @@ -3226,7 +3226,6 @@ static int srpt_add_one(struct ib_device *device)
> >>  		if (ret) {
> >>  			pr_err("MAD registration failed for %s-%d.\n",
> >>  			       dev_name(&sdev->device->dev), i);
> >> -			i--;
> >>  			goto err_port;
> >>  		}
> >>  	}
> >> @@ -3241,6 +3240,8 @@ static int srpt_add_one(struct ib_device *device)
> >>  	return 0;
> >>  
> >>  err_port:
> >> +	for (j = i, i--; j > 0; j--)a
> >> +		cancel_work_sync(&sdev->port[j - 1].work);
> > 
> > There is no need in extra variable, the following code will do the same:
> > 
> > 	while (i--)
> > 		cancel_work_sync(&sdev->port[i].work);
> > 
> >>  	srpt_unregister_mad_agent(sdev, i);
> 
> i is also used here.

So put cancel_work_sync() there.

Thanks

> 
> Junxian
> 
> >>  err_cm:
> >>  	if (sdev->cm_id)
> >> -- 
> >> 2.33.0
> >>
> > 
>