Håkon Bugge
3259862dd7
rds: Fix NULL pointer dereference in __rds_rdma_map
[ Upstream commit f3069c6d33f6ae63a1668737bc78aaaa51bff7ca ]
This is a fix for syzkaller719569, where memory registration was
attempted without any underlying transport being loaded.
Analysis of the case reveals that it is the setsockopt() RDS_GET_MR
(2) and RDS_GET_MR_FOR_DEST (7) that are vulnerable.
Here is an example stack trace when the bug is hit:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000c0
IP: __rds_rdma_map+0x36/0x440 [rds]
PGD 2f93d03067 P4D 2f93d03067 PUD 2f93d02067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: bridge stp llc tun rpcsec_gss_krb5 nfsv4
dns_resolver nfs fscache rds binfmt_misc sb_edac intel_powerclamp
coretemp kvm_intel kvm irqbypass crct10dif_pclmul c rc32_pclmul
ghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd
iTCO_wdt mei_me sg iTCO_vendor_support ipmi_si mei ipmi_devintf nfsd
shpchp pcspkr i2c_i801 ioatd ma ipmi_msghandler wmi lpc_ich mfd_core
auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4 mbcache jbd2
mgag200 i2c_algo_bit drm_kms_helper ixgbe syscopyarea ahci sysfillrect
sysimgblt libahci mdio fb_sys_fops ttm ptp libata sd_mod mlx4_core drm
crc32c_intel pps_core megaraid_sas i2c_core dca dm_mirror
dm_region_hash dm_log dm_mod
CPU: 48 PID: 45787 Comm: repro_set2 Not tainted 4.14.2-3.el7uek.x86_64 #2
Hardware name: Oracle Corporation ORACLE SERVER X5-2L/ASM,MOBO TRAY,2U, BIOS 31110000 03/03/2017
task: ffff882f9190db00 task.stack: ffffc9002b994000
RIP: 0010:__rds_rdma_map+0x36/0x440 [rds]
RSP: 0018:ffffc9002b997df0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff882fa2182580 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffc9002b997e40 RDI: ffff882fa2182580
RBP: ffffc9002b997e30 R08: 0000000000000000 R09: 0000000000000002
R10: ffff885fb29e3838 R11: 0000000000000000 R12: ffff882fa2182580
R13: ffff882fa2182580 R14: 0000000000000002 R15: 0000000020000ffc
FS: 00007fbffa20b700(0000) GS:ffff882fbfb80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000c0 CR3: 0000002f98a66006 CR4: 00000000001606e0
Call Trace:
rds_get_mr+0x56/0x80 [rds]
rds_setsockopt+0x172/0x340 [rds]
? __fget_light+0x25/0x60
? __fdget+0x13/0x20
SyS_setsockopt+0x80/0xe0
do_syscall_64+0x67/0x1b0
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7fbff9b117f9
RSP: 002b:00007fbffa20aed8 EFLAGS: 00000293 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000000c84a4 RCX: 00007fbff9b117f9
RDX: 0000000000000002 RSI: 0000400000000114 RDI: 000000000000109b
RBP: 00007fbffa20af10 R08: 0000000000000020 R09: 00007fbff9dd7860
R10: 0000000020000ffc R11: 0000000000000293 R12: 0000000000000000
R13: 00007fbffa20b9c0 R14: 00007fbffa20b700 R15: 0000000000000021
Code: 41 56 41 55 49 89 fd 41 54 53 48 83 ec 18 8b 87 f0 02 00 00 48
89 55 d0 48 89 4d c8 85 c0 0f 84 2d 03 00 00 48 8b 87 00 03 00 00 <48>
83 b8 c0 00 00 00 00 0f 84 25 03 00 0 0 48 8b 06 48 8b 56 08
The fix is to check the existence of an underlying transport in
__rds_rdma_map().
Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2017-12-16 16:25:45 +01:00 |
| .. |
|
af_rds.c
|
RDS: Add support for SO_TIMESTAMP for incoming messages
|
2016-03-02 14:13:17 -05:00 |
|
bind.c
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
cong.c
|
RDS: split out connection specific state from rds_connection to rds_conn_path
|
2016-06-14 23:50:41 -07:00 |
|
connection.c
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
ib.c
|
IB/core: add support to create a unsafe global rkey to ib_create_pd
|
2016-09-23 13:47:44 -04:00 |
|
ib.h
|
RDS: add __printf format attribute to error reporting functions
|
2016-08-08 16:16:21 -07:00 |
|
ib_cm.c
|
rds: ib: add error handle
|
2017-10-08 10:26:10 +02:00 |
|
ib_fmr.c
|
RDS: IB: move FMR code to its own file
|
2016-03-02 14:13:18 -05:00 |
|
ib_frmr.c
|
RDS: RDMA: fix the ib_map_mr_sg_zbva() argument
|
2017-11-30 08:39:10 +00:00 |
|
ib_mr.h
|
RDS: IB: Support Fastreg MR (FRMR) memory registration mode
|
2016-03-02 14:13:19 -05:00 |
|
ib_rdma.c
|
RDS: split out connection specific state from rds_connection to rds_conn_path
|
2016-06-14 23:50:41 -07:00 |
|
ib_recv.c
|
RDS: TCP: make receive path use the rds_conn_path
|
2016-07-01 16:45:17 -04:00 |
|
ib_ring.c
|
|
|
|
ib_send.c
|
RDS: RDMA: Fix the composite message user notification
|
2017-10-08 10:26:02 +02:00 |
|
ib_stats.c
|
RDS: IB: add mr reused stats
|
2016-03-02 14:13:19 -05:00 |
|
ib_sysctl.c
|
net: Convert uses of typedef ctl_table to struct ctl_table
|
2013-06-13 02:36:09 -07:00 |
|
info.c
|
rds: fix an integer overflow test in rds_info_getsockopt()
|
2015-08-03 15:20:16 -07:00 |
|
info.h
|
|
|
|
Kconfig
|
RDS: Drop stale iWARP RDMA transport
|
2016-03-02 14:13:17 -05:00 |
|
loop.c
|
RDS: TCP: Hooks to set up a single connection path
|
2016-07-01 16:45:17 -04:00 |
|
loop.h
|
|
|
|
Makefile
|
rds: debug messages are enabled by default
|
2016-10-29 15:55:57 -04:00 |
|
message.c
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
page.c
|
RDS: memory allocated must be align to 8
|
2016-04-07 16:58:27 -04:00 |
|
rdma.c
|
rds: Fix NULL pointer dereference in __rds_rdma_map
|
2017-12-16 16:25:45 +01:00 |
|
rdma_transport.c
|
RDS: split out connection specific state from rds_connection to rds_conn_path
|
2016-06-14 23:50:41 -07:00 |
|
rdma_transport.h
|
RDS: Drop stale iWARP RDMA transport
|
2016-03-02 14:13:17 -05:00 |
|
rds.h
|
RDS: make message size limit compliant with spec
|
2017-11-30 08:39:10 +00:00 |
|
rds_single_path.h
|
RDS: split out connection specific state from rds_connection to rds_conn_path
|
2016-06-14 23:50:41 -07:00 |
|
recv.c
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
send.c
|
RDS: RDMA: return appropriate error on rdma map failures
|
2017-11-30 08:39:10 +00:00 |
|
stats.c
|
net/rds: zero last byte for strncpy
|
2013-03-08 00:35:44 -05:00 |
|
sysctl.c
|
net: rds: fix coding style issues
|
2016-06-18 21:34:09 -07:00 |
|
tcp.c
|
rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races
|
2017-12-14 09:28:20 +01:00 |
|
tcp.h
|
rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races
|
2017-12-14 09:28:20 +01:00 |
|
tcp_connect.c
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
tcp_listen.c
|
rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races
|
2017-12-14 09:28:20 +01:00 |
|
tcp_recv.c
|
RDS: TCP: make receive path use the rds_conn_path
|
2016-07-01 16:45:17 -04:00 |
|
tcp_send.c
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
tcp_stats.c
|
net: rds: fix const array syntax
|
2011-07-01 16:16:19 -07:00 |
|
threads.c
|
RDS: TCP: Enable multipath RDS for TCP
|
2016-07-15 11:36:58 -07:00 |
|
transport.c
|
net: rds: fix coding style issues
|
2016-06-18 21:34:09 -07:00 |