| Message ID | 20250412075714.3257358-1-yanjun.zhu@linux.dev (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug | expand |
On Sat, April 12, 2025 4:57 PM Zhu Yanjun wrote: > > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:94 [inline] > dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 > print_address_description mm/kasan/report.c:378 [inline] > print_report+0xcf/0x610 mm/kasan/report.c:489 > kasan_report+0xb5/0xe0 mm/kasan/report.c:602 > rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195 > rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132 > __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232 > rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109 > create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052 > ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095 > ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679 > vfs_write fs/read_write.c:677 [inline] > vfs_write+0x26a/0xcc0 fs/read_write.c:659 > ksys_write+0x1b8/0x200 fs/read_write.c:731 > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > In the function rxe_create_cq, when rxe_cq_from_init fails, the function > rxe_cleanup will be called to handle the allocated resources. In fact, > some memory resources have already been freed in the function > rxe_cq_from_init. Thus, this problem will occur. > > The solution is to let rxe_cleanup do all the work. > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > Link: https://paste.ubuntu.com/p/tJgC42wDf6/ > Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn> > Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com> The fix looks correct. Thank you. > --- > drivers/infiniband/sw/rxe/rxe_cq.c | 5 +---- > 1 file changed, 1 insertion(+), 4 deletions(-) > > diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c > index fec87c9030ab..fffd144d509e 100644 > --- a/drivers/infiniband/sw/rxe/rxe_cq.c > +++ b/drivers/infiniband/sw/rxe/rxe_cq.c > @@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, > > err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata, > cq->queue->buf, cq->queue->buf_size, &cq->queue->ip); > - if (err) { > - vfree(cq->queue->buf); > - kfree(cq->queue); > + if (err) > return err; > - } > > cq->is_user = uresp; > > -- > 2.34.1 >
On 14.04.25 12:49, Daisuke Matsuda (Fujitsu) wrote: > On Sat, April 12, 2025 4:57 PM Zhu Yanjun wrote: >> >> Call Trace: >> <TASK> >> __dump_stack lib/dump_stack.c:94 [inline] >> dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 >> print_address_description mm/kasan/report.c:378 [inline] >> print_report+0xcf/0x610 mm/kasan/report.c:489 >> kasan_report+0xb5/0xe0 mm/kasan/report.c:602 >> rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195 >> rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132 >> __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232 >> rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109 >> create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052 >> ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095 >> ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679 >> vfs_write fs/read_write.c:677 [inline] >> vfs_write+0x26a/0xcc0 fs/read_write.c:659 >> ksys_write+0x1b8/0x200 fs/read_write.c:731 >> do_syscall_x64 arch/x86/entry/common.c:52 [inline] >> do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 >> entry_SYSCALL_64_after_hwframe+0x77/0x7f >> >> In the function rxe_create_cq, when rxe_cq_from_init fails, the function >> rxe_cleanup will be called to handle the allocated resources. In fact, >> some memory resources have already been freed in the function >> rxe_cq_from_init. Thus, this problem will occur. >> >> The solution is to let rxe_cleanup do all the work. >> >> Fixes: 8700e3e7c485 ("Soft RoCE driver") >> Link: https://paste.ubuntu.com/p/tJgC42wDf6/ >> Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn> >> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> > > Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com> > > The fix looks correct. Thanks a lot. Zhu Yanjun > Thank you. > >> --- >> drivers/infiniband/sw/rxe/rxe_cq.c | 5 +---- >> 1 file changed, 1 insertion(+), 4 deletions(-) >> >> diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c >> index fec87c9030ab..fffd144d509e 100644 >> --- a/drivers/infiniband/sw/rxe/rxe_cq.c >> +++ b/drivers/infiniband/sw/rxe/rxe_cq.c >> @@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, >> >> err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata, >> cq->queue->buf, cq->queue->buf_size, &cq->queue->ip); >> - if (err) { >> - vfree(cq->queue->buf); >> - kfree(cq->queue); >> + if (err) >> return err; >> - } >> >> cq->is_user = uresp; >> >> -- >> 2.34.1 >>
diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c index fec87c9030ab..fffd144d509e 100644 --- a/drivers/infiniband/sw/rxe/rxe_cq.c +++ b/drivers/infiniband/sw/rxe/rxe_cq.c @@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata, cq->queue->buf, cq->queue->buf_size, &cq->queue->ip); - if (err) { - vfree(cq->queue->buf); - kfree(cq->queue); + if (err) return err; - } cq->is_user = uresp;
Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcf/0x610 mm/kasan/report.c:489 kasan_report+0xb5/0xe0 mm/kasan/report.c:602 rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195 rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132 __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232 rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109 create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052 ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095 ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679 vfs_write fs/read_write.c:677 [inline] vfs_write+0x26a/0xcc0 fs/read_write.c:659 ksys_write+0x1b8/0x200 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f In the function rxe_create_cq, when rxe_cq_from_init fails, the function rxe_cleanup will be called to handle the allocated resources. In fact, some memory resources have already been freed in the function rxe_cq_from_init. Thus, this problem will occur. The solution is to let rxe_cleanup do all the work. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://paste.ubuntu.com/p/tJgC42wDf6/ Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> --- drivers/infiniband/sw/rxe/rxe_cq.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)