[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <67051b0b.050a0220.1e4d62.008f.GAE@google.com>
Date: Tue, 08 Oct 2024 04:44:11 -0700
From: syzbot <syzbot+5fe14f2ff4ccbace9a26@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.
***
Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
Author: leon@...nel.org
On Mon, Oct 07, 2024 at 06:44:02PM -0700, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit 5f8ca04fdd3c66a322ea318b5f1cb684dd56e5b2
> Author: Chiara Meiohas <cmeiohas@...dia.com>
> Date: Mon Sep 9 17:30:22 2024 +0000
>
> RDMA/device: Remove optimization in ib_device_get_netdev()
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16db2327980000
> start commit: c4a14f6d9d17 ipv4: ip_gre: Fix drops of small packets in i..
> git tree: net
> final oops: https://syzkaller.appspot.com/x/report.txt?x=15db2327980000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11db2327980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=b2d4fdf18a83ec0b
> dashboard link: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11eca3d0580000
>
> Reported-by: syzbot+5fe14f2ff4ccbace9a26@...kaller.appspotmail.com
> Fixes: 5f8ca04fdd3c ("RDMA/device: Remove optimization in ib_device_get_netdev()")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-next
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index e029401b5680..f56085b928a4 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -2070,10 +2070,6 @@ static int iw_query_port(struct ib_device *device,
memset(port_attr, 0, sizeof(*port_attr));
- netdev = ib_device_get_netdev(device, port_num);
- if (!netdev)
- return -ENODEV;
-
port_attr->max_mtu = IB_MTU_4096;
port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
@@ -2096,7 +2092,6 @@ static int iw_query_port(struct ib_device *device,
rcu_read_unlock();
}
- dev_put(netdev);
return device->ops.query_port(device, port_num, port_attr);
}
@@ -2134,13 +2129,27 @@ int ib_query_port(struct ib_device *device,
u32 port_num,
struct ib_port_attr *port_attr)
{
+ struct net_device *netdev = NULL;
+ int ret;
+
if (!rdma_is_port_valid(device, port_num))
return -EINVAL;
+ if (rdma_protocol_iwarp(device, port_num) ||
+ rdma_protocol_roce(device, port_num)) {
+ netdev = ib_device_get_netdev(device, port_num);
+ if (!netdev)
+ return -ENODEV;
+ }
+
if (rdma_protocol_iwarp(device, port_num))
- return iw_query_port(device, port_num, port_attr);
+ ret = iw_query_port(device, port_num, port_attr);
else
- return __ib_query_port(device, port_num, port_attr);
+ ret = __ib_query_port(device, port_num, port_attr);
+ if (netdev)
+ dev_put(netdev);
+ return ret;
+
}
EXPORT_SYMBOL(ib_query_port);
Powered by blists - more mailing lists