lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231025083507.GB2950466@unreal> Date: Wed, 25 Oct 2023 11:35:07 +0300 From: Leon Romanovsky <leon@...nel.org> To: Qing Huang <qing.huang@...cle.com> Cc: George Kennedy <george.kennedy@...cle.com>, "jgg@...pe.ca" <jgg@...pe.ca>, "sd@...asysnail.net" <sd@...asysnail.net>, "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, Tom Hromatka <tom.hromatka@...cle.com>, Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com> Subject: Re: [PATCH v2] mlx5: fix init stage error handling to avoid double free of same QP and UAF On Wed, Oct 25, 2023 at 12:15:36AM +0000, Qing Huang wrote: > > > -----Original Message----- > > From: George Kennedy <george.kennedy@...cle.com> > > Sent: Tuesday, October 24, 2023 11:02 AM > > To: leon@...nel.org; jgg@...pe.ca; sd@...asysnail.net; linux- > > rdma@...r.kernel.org; linux-kernel@...r.kernel.org; netdev@...r.kernel.org > > Cc: George Kennedy <george.kennedy@...cle.com>; Tom Hromatka > > <tom.hromatka@...cle.com>; Harshit Mogalapalli > > <harshit.m.mogalapalli@...cle.com> > > Subject: [PATCH v2] mlx5: fix init stage error handling to avoid double free of > > same QP and UAF > > > > In the unlikely event that workqueue allocation fails and returns NULL in > > mlx5_mkey_cache_init(), delete the call to > > mlx5r_umr_resource_cleanup() (which frees the QP) in > > mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of > > the same QP when __mlx5_ib_add() does its cleanup. > > > > > Hi George, > > There seems no cleanup function defined for this stage: > > STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, > mlx5_ib_stage_post_ib_reg_umr_init, > NULL), > > Do you know where __mlx5_ib_add() does the double free call after the allocation failure? It is done in MLX5_IB_STAGE_PRE_IB_REG_UMR. Unfortunately, we have asymmetric init/release flow for UMRs. Thanks > > Regards, > Qing > > > Syzkaller reported a UAF in ib_destroy_qp_user > > > > workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR > > infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): > > failed to create work queue > > infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): > > mr cache init failed -12 > > ================================================================== > > BUG: KASAN: slab-use-after-free in ib_destroy_qp_user > > (drivers/infiniband/core/verbs.c:2073) > > Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642 > > > > Call Trace: > > <TASK> > > kasan_report (mm/kasan/report.c:590) > > ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) > > mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) > > __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) > > mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) > > ... > > </TASK> > > > > Allocated by task 1642: > > __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 > > mm/slab_common.c:1039) > > create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 > > ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) > > ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) > > mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) > > mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) > > __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) > > mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) > > ... > > > > Freed by task 1642: > > __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) > > ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) > > mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) > > mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 > > drivers/infiniband/hw/mlx5/main.c:4065) > > __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) > > mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) > > ... > > > > The buggy address belongs to the object at ffff88810da31000 which belongs to > > the cache kmalloc-2k of size 2048 The buggy address is located 168 bytes inside > > of freed 2048-byte region [ffff88810da31000, ffff88810da31800) > > > > The buggy address belongs to the physical page: > > page:000000003b5e469d refcount:1 mapcount:0 mapping:0000000000000000 > > index:0x0 pfn:0x10da30 > > head:000000003b5e469d order:3 entire_mapcount:0 nr_pages_mapped:0 > > pincount:0 > > flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff) > > page_type: 0xffffffff() > > raw: 0017ffffc0000840 ffff888100042f00 ffffea0004180800 > > dead000000000002 > > raw: 0000000000000000 0000000000080008 00000001ffffffff > > 0000000000000000 page dumped because: kasan: bad access detected > > > > Memory state around the buggy address: > > ffff88810da30f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffff88810da31000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > >ffff88810da31080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > ^ > > ffff88810da31100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > ffff88810da31180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > ================================================================== > > Disabling lock debugging due to kernel taint > > > > Fixes: 04876c12c19e ("RDMA/mlx5: Move init and cleanup of UMR to umr.c") > > Reported-by: syzkaller <syzkaller@...glegroups.com> > > Suggested-by: Leon Romanovsky <leon@...nel.org> > > Signed-off-by: George Kennedy <george.kennedy@...cle.com> > > --- > > v2: went with fix suggested by: Leon Romanovsky <leon@...nel.org> > > > > drivers/infiniband/hw/mlx5/main.c | 4 +--- > > 1 file changed, 1 insertion(+), 3 deletions(-) > > > > diff --git a/drivers/infiniband/hw/mlx5/main.c > > b/drivers/infiniband/hw/mlx5/main.c > > index 555629b7..5d963ab 100644 > > --- a/drivers/infiniband/hw/mlx5/main.c > > +++ b/drivers/infiniband/hw/mlx5/main.c > > @@ -4071,10 +4071,8 @@ static int > > mlx5_ib_stage_post_ib_reg_umr_init(struct mlx5_ib_dev *dev) > > return ret; > > > > ret = mlx5_mkey_cache_init(dev); > > - if (ret) { > > + if (ret) > > mlx5_ib_warn(dev, "mr cache init failed %d\n", ret); > > - mlx5r_umr_resource_cleanup(dev); > > - } > > return ret; > > } > > > > -- > > 1.8.3.1 >
Powered by blists - more mailing lists