Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1686663 > unrolled thread

[PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-13 17:50 +0200
    RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds "Ismail, Mustafa" <mustafa.ismail@intel.com> - 2017-07-13 18:00 +0200
      Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-13 18:30 +0200
        RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds "Ismail, Mustafa" <mustafa.ismail@intel.com> - 2017-07-13 20:50 +0200
          Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-14 08:50 +0200
            RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds "Ismail, Mustafa" <mustafa.ismail@intel.com> - 2017-07-14 17:00 +0200
        RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds "Marciniszyn, Mike" <mike.marciniszyn@intel.com> - 2017-07-17 19:40 +0200
          Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-17 21:30 +0200
            RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by  user verbs cmds "Marciniszyn, Mike" <mike.marciniszyn@intel.com> - 2017-07-17 21:30 +0200

#1686663 — [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boris Pismenny <borisp@mellanox.com>

commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream.

The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive
the port number from user input as part of its attributes and assumes
it is valid. Down on the stack, that parameter is used to access kernel
data structures.  If the value is invalid, the kernel accesses memory
it should not.  To prevent this, verify the port number before using it.

BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0
Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313

BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0
Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819

Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands")
Cc: Yevgeny Kliteynik <kliteyn@mellanox.com>
Cc: Tziporet Koren <tziporet@mellanox.com>
Cc: Alex Polak <alexpo@mellanox.com>
Signed-off-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

Modified from upstream commit: helper function rdma_is_port_valid does not
exist in these kernel versions, so use manual comparisons instead.

 drivers/infiniband/core/uverbs_cmd.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2287,6 +2287,10 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
+	if (cmd.port_num < rdma_start_port(ib_dev) ||
+	    cmd.port_num > rdma_end_port(ib_dev))
+		return -EINVAL;
+
 	INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
 		   out_len);
 
@@ -2827,6 +2831,10 @@ ssize_t ib_uverbs_create_ah(struct ib_uv
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
+	if (cmd.attr.port_num < rdma_start_port(ib_dev) ||
+	    cmd.attr.port_num > rdma_end_port(ib_dev))
+		return -EINVAL;
+
 	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 	if (!uobj)
 		return -ENOMEM;

[toc] | [next] | [standalone]

#1686708 — RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

> Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by
> user verbs cmds
> 
> 4.4-stable review patch.  If anyone has any objections, please let me know.

Yes, this breaks modify qp.
See https://patchwork.kernel.org/patch/9830663/

Mustafa

[toc] | [prev] | [next] | [standalone]

#1686763 — Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

On Thu, Jul 13, 2017 at 03:54:28PM +0000, Ismail, Mustafa wrote:
> > Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by
> > user verbs cmds
> > 
> > 4.4-stable review patch.  If anyone has any objections, please let me know.
> 
> Yes, this breaks modify qp.
> See https://patchwork.kernel.org/patch/9830663/

I don't understand this response at all, sorry.

What should I do about this?  Is this patch alone a problem?  Is there
some other patch I should apply that is in Linus's tree?  Where is the
problem, only in this old release?

totally confused,

greg k-h

[toc] | [prev] | [next] | [standalone]

#1686843 — RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

> -----Original Message-----
> From: Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
> Sent: Thursday, July 13, 2017 11:26 AM
> To: Ismail, Mustafa <mustafa.ismail@intel.com>
> Cc: linux-kernel@vger.kernel.org; linux-rdma@vger.kernel.org;
> stable@vger.kernel.org; Yevgeny Kliteynik <kliteyn@mellanox.com>;
> Tziporet Koren <tziporet@mellanox.com>; Alex Polak
> <alexpo@mellanox.com>; Boris Pismenny <borisp@mellanox.com>; Leon
> Romanovsky <leon@kernel.org>; Doug Ledford <dledford@redhat.com>
> Subject: Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> by user verbs cmds
> 
> On Thu, Jul 13, 2017 at 03:54:28PM +0000, Ismail, Mustafa wrote:
> > > Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> > > by user verbs cmds
> > >
> > > 4.4-stable review patch.  If anyone has any objections, please let me
> know.
> >
> > Yes, this breaks modify qp.
> > See https://patchwork.kernel.org/patch/9830663/
> 
> I don't understand this response at all, sorry.
> 
> What should I do about this?  Is this patch alone a problem?  Is there some
> other patch I should apply that is in Linus's tree?  Where is the problem,
> only in this old release?
> 
Applying this patch will break RDMA functionality with respect to modify_qp.
Specifically this part:
+	if (cmd.port_num < rdma_start_port(ib_dev) ||
+	    cmd.port_num > rdma_end_port(ib_dev))
+		return -EINVAL;
+
The cmd.port_num is only valid if (cmd->base.attr_mask & IB_QP_PORT).
So the above can be fixed with:
	if ((cmd->base.attr_mask & IB_QP_PORT) && 
	    (cmd.port_num < rdma_start_port(ib_dev) ||
	    cmd.port_num > rdma_end_port(ib_dev)))
		return -EINVAL;

A version of this patch is in Linus's tree and it has the same problem:
commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b    "RDMA/uverbs: Check port number supplied by user verbs cmds"

We will be submitting a patch to fix this shortly.

Mustafa

[toc] | [prev] | [next] | [standalone]

#1687105 — Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

On Thu, Jul 13, 2017 at 06:44:38PM +0000, Ismail, Mustafa wrote:
> > -----Original Message-----
> > From: Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
> > Sent: Thursday, July 13, 2017 11:26 AM
> > To: Ismail, Mustafa <mustafa.ismail@intel.com>
> > Cc: linux-kernel@vger.kernel.org; linux-rdma@vger.kernel.org;
> > stable@vger.kernel.org; Yevgeny Kliteynik <kliteyn@mellanox.com>;
> > Tziporet Koren <tziporet@mellanox.com>; Alex Polak
> > <alexpo@mellanox.com>; Boris Pismenny <borisp@mellanox.com>; Leon
> > Romanovsky <leon@kernel.org>; Doug Ledford <dledford@redhat.com>
> > Subject: Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> > by user verbs cmds
> > 
> > On Thu, Jul 13, 2017 at 03:54:28PM +0000, Ismail, Mustafa wrote:
> > > > Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> > > > by user verbs cmds
> > > >
> > > > 4.4-stable review patch.  If anyone has any objections, please let me
> > know.
> > >
> > > Yes, this breaks modify qp.
> > > See https://patchwork.kernel.org/patch/9830663/
> > 
> > I don't understand this response at all, sorry.
> > 
> > What should I do about this?  Is this patch alone a problem?  Is there some
> > other patch I should apply that is in Linus's tree?  Where is the problem,
> > only in this old release?
> > 
> Applying this patch will break RDMA functionality with respect to modify_qp.
> Specifically this part:
> +	if (cmd.port_num < rdma_start_port(ib_dev) ||
> +	    cmd.port_num > rdma_end_port(ib_dev))
> +		return -EINVAL;
> +
> The cmd.port_num is only valid if (cmd->base.attr_mask & IB_QP_PORT).
> So the above can be fixed with:
> 	if ((cmd->base.attr_mask & IB_QP_PORT) && 
> 	    (cmd.port_num < rdma_start_port(ib_dev) ||
> 	    cmd.port_num > rdma_end_port(ib_dev)))
> 		return -EINVAL;
> 
> A version of this patch is in Linus's tree and it has the same problem:
> commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b    "RDMA/uverbs: Check port number supplied by user verbs cmds"
> 
> We will be submitting a patch to fix this shortly.

Ok, so we will be "bug compatible" with Linus's tree then, right? :)

Should I hold off on applying this now, or just stay in sync and wait
for your fixes to land in Linus's tree?  I vote stay-in-sync, as the
other stable trees are also "broken" in the same way right now...

thanks,

greg k-h

[toc] | [prev] | [next] | [standalone]

#1687493 — RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

> -----Original Message-----
> From: Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
> Sent: Friday, July 14, 2017 1:49 AM
> To: Ismail, Mustafa <mustafa.ismail@intel.com>
> Cc: linux-kernel@vger.kernel.org; linux-rdma@vger.kernel.org;
> stable@vger.kernel.org; Yevgeny Kliteynik <kliteyn@mellanox.com>;
> Tziporet Koren <tziporet@mellanox.com>; Alex Polak
> <alexpo@mellanox.com>; Boris Pismenny <borisp@mellanox.com>; Leon
> Romanovsky <leon@kernel.org>; Doug Ledford <dledford@redhat.com>
> Subject: Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> by user verbs cmds
> 
> On Thu, Jul 13, 2017 at 06:44:38PM +0000, Ismail, Mustafa wrote:
> > > -----Original Message-----
> > > From: Greg Kroah-Hartman [mailto:gregkh@linuxfoundation.org]
> > > Sent: Thursday, July 13, 2017 11:26 AM
> > > To: Ismail, Mustafa <mustafa.ismail@intel.com>
> > > Cc: linux-kernel@vger.kernel.org; linux-rdma@vger.kernel.org;
> > > stable@vger.kernel.org; Yevgeny Kliteynik <kliteyn@mellanox.com>;
> > > Tziporet Koren <tziporet@mellanox.com>; Alex Polak
> > > <alexpo@mellanox.com>; Boris Pismenny <borisp@mellanox.com>;
> Leon
> > > Romanovsky <leon@kernel.org>; Doug Ledford
> <dledford@redhat.com>
> > > Subject: Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number
> > > supplied by user verbs cmds
> > >
> > > On Thu, Jul 13, 2017 at 03:54:28PM +0000, Ismail, Mustafa wrote:
> > > > > Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number
> > > > > supplied by user verbs cmds
> > > > >
> > > > > 4.4-stable review patch.  If anyone has any objections, please
> > > > > let me
> > > know.
> > > >
> > > > Yes, this breaks modify qp.
> > > > See https://patchwork.kernel.org/patch/9830663/
> > >
> > > I don't understand this response at all, sorry.
> > >
> > > What should I do about this?  Is this patch alone a problem?  Is
> > > there some other patch I should apply that is in Linus's tree?
> > > Where is the problem, only in this old release?
> > >
> > Applying this patch will break RDMA functionality with respect to
> modify_qp.
> > Specifically this part:
> > +	if (cmd.port_num < rdma_start_port(ib_dev) ||
> > +	    cmd.port_num > rdma_end_port(ib_dev))
> > +		return -EINVAL;
> > +
> > The cmd.port_num is only valid if (cmd->base.attr_mask & IB_QP_PORT).
> > So the above can be fixed with:
> > 	if ((cmd->base.attr_mask & IB_QP_PORT) &&
> > 	    (cmd.port_num < rdma_start_port(ib_dev) ||
> > 	    cmd.port_num > rdma_end_port(ib_dev)))
> > 		return -EINVAL;
> >
> > A version of this patch is in Linus's tree and it has the same problem:
> > commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b
> "RDMA/uverbs: Check port number supplied by user verbs cmds"
> >
> > We will be submitting a patch to fix this shortly.
> 
> Ok, so we will be "bug compatible" with Linus's tree then, right? :)
> 
> Should I hold off on applying this now, or just stay in sync and wait for your
> fixes to land in Linus's tree?  I vote stay-in-sync, as the other stable trees are
> also "broken" in the same way right now...
> 

I was thinking it would be better not to break iWARP and possibly other RDMA protocols, in  more stable trees if possible and apply the patch and fix at the same time.
But I see your point.

Regards,

Mustafa

> thanks,
> 
> greg k-h

[toc] | [prev] | [next] | [standalone]

#1689299 — RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

> Subject: Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> by user verbs cmds
> 
> On Thu, Jul 13, 2017 at 03:54:28PM +0000, Ismail, Mustafa wrote:
> > > Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> by
> > > user verbs cmds
> > >
> > > 4.4-stable review patch.  If anyone has any objections, please let me
> know.
> >
> > Yes, this breaks modify qp.
> > See https://patchwork.kernel.org/patch/9830663/
> 
> I don't understand this response at all, sorry.
> 
> What should I do about this?  Is this patch alone a problem?  Is there
> some other patch I should apply that is in Linus's tree?  Where is the
> problem, only in this old release?
> 
> totally confused,
> 

This patch utterly breaks qib and hfi1 on at least 4.10.11 stable kernel.

I suspect and will soon verify that v4.13-rc1 is broke as well.

Mike

[toc] | [prev] | [next] | [standalone]

#1689382 — Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

On Mon, Jul 17, 2017 at 05:30:45PM +0000, Marciniszyn, Mike wrote:
> > Subject: Re: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> > by user verbs cmds
> > 
> > On Thu, Jul 13, 2017 at 03:54:28PM +0000, Ismail, Mustafa wrote:
> > > > Subject: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied
> > by
> > > > user verbs cmds
> > > >
> > > > 4.4-stable review patch.  If anyone has any objections, please let me
> > know.
> > >
> > > Yes, this breaks modify qp.
> > > See https://patchwork.kernel.org/patch/9830663/
> > 
> > I don't understand this response at all, sorry.
> > 
> > What should I do about this?  Is this patch alone a problem?  Is there
> > some other patch I should apply that is in Linus's tree?  Where is the
> > problem, only in this old release?
> > 
> > totally confused,
> > 
> 
> This patch utterly breaks qib and hfi1 on at least 4.10.11 stable kernel.
> 
> I suspect and will soon verify that v4.13-rc1 is broke as well.

it should be broken, see the patches submitted already to fix it :)

[toc] | [prev] | [next] | [standalone]

#1689389 — RE: [PATCH 4.4 29/57] RDMA/uverbs: Check port number supplied by user verbs cmds

> it should be broken, see the patches submitted already to fix it :)

I saw that and responded with Tested-by:

Mike

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web