| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20180914212021.GD3876@unicorn.suse.cz>
Date: Fri, 14 Sep 2018 23:20:21 +0200
From: Michal Kubecek <mkubecek@...e.cz>
To: netdev@...r.kernel.org
Cc: Saeed Mahameed <saeedm@...lanox.com>,
Leon Romanovsky <leon@...nel.org>
Subject: mlx5_core: null pointer dereference in mlx5_accel_tls_device_caps()
(net-next kernel)
I just encountered a null pointer dereference on mlx5_core module
initialization while booting net-next kernel (based on commit
ee4fccbee7d3) on an aarch64 machine:
[ 12.021971] iommu: Adding device 0000:01:00.0 to group 3
[ 12.022925] mlx5_core 0000:01:00.0: firmware version: 12.17.2020
[ 12.022954] mlx5_core 0000:01:00.0: 63.008 Gb/s available PCIe bandwidth (8 GT/s x8 link)
[ 12.068709] Adding 98830144k swap on /dev/sda4. Priority:-2 extents:1 across:98830144k FS
[ 12.347571] (0000:01:00.0): E-Switch: Total vports 9, per vport: max uc(1024) max mc(16384)
[ 12.351962] mlx5_core 0000:01:00.0: Port module event: module 0, Cable plugged
[ 12.366306] mlx5_core 0000:01:00.0: MLX5E: StrdRq(0) RqSz(1024) StrdSz(128) RxCqeCmprss(0)
[ 12.366741] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050
[ 12.374603] Mem abort info:
[ 12.377368] ESR = 0x96000004
[ 12.380406] Exception class = DABT (current EL), IL = 32 bits
[ 12.386357] SET = 0, FnV = 0
[ 12.389347] EA = 0, S1PTW = 0
[ 12.392471] Data abort info:
[ 12.395343] ISV = 0, ISS = 0x00000004
[ 12.399156] CM = 0, WnR = 0
[ 12.402108] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
[ 12.408711] [0000000000000050] pgd=0000000000000000
[ 12.413567] Internal error: Oops: 96000004 [#1] SMP
[ 12.418427] Modules linked in: fat mlx5_core(+) ipmi_ssif(+) aes_ce_blk crypto_simd cryptd aes_ce_cipher crc32_ce crct10dif_ce ghash_ce aes_arm64 sha2_ce sha256_arm64 sha1_ce ipmi_devintf ipmi_msghandler sbsa_gwdt tls mlxfw devlink at803x qcom_emac btrfs libcrc32c xor zlib_deflate raid6_pq ahci_platform libahci_platform hdma hdma_mgmt i2c_qup sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua efivarfs
[ 12.454800] CPU: 40 PID: 742 Comm: systemd-udevd Not tainted 4.19.0-rc3-ethnl.15-default #1
[ 12.463131] Hardware name: To be filled by O.E.M. To be filled by O.E.M./To be filled by O.E.M., BIOS 5.13 12/12/2012
[ 12.473722] pstate: 60400005 (nZCv daif +PAN -UAO)
[ 12.478559] pc : mlx5_accel_tls_device_caps+0x28/0x38 [mlx5_core]
[ 12.484598] lr : mlx5e_tls_build_netdev+0x24/0x98 [mlx5_core]
[ 12.490301] sp : ffff000021873a30
[ 12.493599] x29: ffff000021873a30 x28: ffff2a72560a7940
[ 12.498895] x27: ffff2a7256df6000 x26: ffff2a71a0fed650
[ 12.504190] x25: 0000000000000000 x24: ffff92c7f2b988c0
[ 12.509485] x23: ffff92c7fe01c0c0 x22: ffff2a71a0fcfa70
[ 12.514780] x21: ffff92c7f2b808c0 x20: ffff92c7f741c110
[ 12.520075] x19: ffff92c7f2b988c0 x18: ffff0000218739b0
[ 12.525370] x17: 0000000000000000 x16: ffff2a725625ade0
[ 12.530665] x15: 0000000029818ed4 x14: 00000000d47aab07
[ 12.535961] x13: 8a24000000000000 x12: 0000000000000000
[ 12.541256] x11: 0000000000000000 x10: 0000000000000000
[ 12.546551] x9 : 0000000000000000 x8 : 0000000000000000
[ 12.551846] x7 : 0000000000000000 x6 : ffff92c8159dc910
[ 12.557141] x5 : 0000000000000400 x4 : ffff7e4b205a20c7
[ 12.562436] x3 : 0000000000000000 x2 : ffff2a725625ae1c
[ 12.567731] x1 : 00000000ab078a24 x0 : 0000000000000000
[ 12.573027] Process systemd-udevd (pid: 742, stack limit = 0x(____ptrval____))
[ 12.580232] Call trace:
[ 12.582688] mlx5_accel_tls_device_caps+0x28/0x38 [mlx5_core]
[ 12.588419] mlx5e_build_nic_netdev+0x27c/0x348 [mlx5_core]
[ 12.593974] mlx5e_nic_init+0x1a0/0x258 [mlx5_core]
[ 12.598835] mlx5e_create_netdev+0x74/0x118 [mlx5_core]
[ 12.604043] mlx5e_add+0xf0/0x2c0 [mlx5_core]
[ 12.608384] mlx5_add_device+0x88/0x1a8 [mlx5_core]
[ 12.613246] mlx5_register_interface+0x78/0xb0 [mlx5_core]
[ 12.618713] mlx5e_init+0x24/0x30 [mlx5_core]
[ 12.623052] init+0x88/0xa0 [mlx5_core]
[ 12.626850] do_one_initcall+0x54/0x200
[ 12.630667] do_init_module+0x64/0x1d8
[ 12.634401] load_module+0x1480/0x1510
[ 12.638132] __se_sys_finit_module+0xc8/0xd8
[ 12.642385] __arm64_sys_finit_module+0x24/0x30
[ 12.646901] el0_svc_common+0x7c/0x118
[ 12.650631] el0_svc_handler+0x38/0x78
[ 12.654364] el0_svc+0x8/0xc
[ 12.657229] Code: d503201f f97c7e60 f9400bf3 a8c27bfd (f9402800)
[ 12.663306] ---[ end trace 57e772dd3cf718f1 ]---
The function looks like this:
------------------------------------------------------------------------
drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c:
68 {
0x0000000000058230 <+0>: stp x29, x30, [sp, #-32]!
0x0000000000058234 <+4>: mov x29, sp
0x0000000000058238 <+8>: str x19, [sp, #16]
0x000000000005823c <+12>: mov x19, x0
0x0000000000058240 <+16>: mov x0, x30
drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.h:
68 return mdev->fpga->tls->caps;
0x0000000000058244 <+20>: add x19, x19, #0x38, lsl #12
drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c:
68 {
0x0000000000058248 <+24>: bl 0x58248
<mlx5_accel_tls_device_caps+24>
drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.h:
68 return mdev->fpga->tls->caps;
0x000000000005824c <+28>: ldr x0, [x19, #30968]
drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c:
70 }
0x0000000000058250 <+32>: ldr x19, [sp, #16]
0x0000000000058254 <+36>: ldp x29, x30, [sp], #32
drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.h:
68 return mdev->fpga->tls->caps;
0x0000000000058258 <+40>: ldr x0, [x0, #80]
drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c:
70 }
0x000000000005825c <+44>: ldr w0, [x0, #20]
0x0000000000058260 <+48>: ret
------------------------------------------------------------------------
so IIUC mdev->fpga is null (offset of tls in struct mlx5_fpga_device is
indeed 80 = 0x50).
The NIC is
Model: "Mellanox MT27700 Family [ConnectX-4]"
Vendor: pci 0x15b3 "Mellanox Technologies"
Device: pci 0x1013 "MT27700 Family [ConnectX-4]"
SubVendor: pci 0x15b3 "Mellanox Technologies"
SubDevice: pci 0x0003
Michal Kubecek
Powered by blists - more mailing lists