kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Zhu Yanjun 10c7f1c647 RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem 
[ Upstream commit d0706bfd3e ]

Call Trace:

 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 strlen+0x93/0xa0 lib/string.c:420
 __fortify_strlen include/linux/fortify-string.h:268 [inline]
 get_kobj_path_length lib/kobject.c:118 [inline]
 kobject_get_path+0x3f/0x2a0 lib/kobject.c:158
 kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545
 ib_register_device drivers/infiniband/core/device.c:1472 [inline]
 ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393
 rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552
 rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550
 rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225
 nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796
 rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195
 rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450
 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
 netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg net/socket.c:727 [inline]
 ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
 __sys_sendmsg+0x16d/0x220 net/socket.c:2652
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

This problem is similar to the problem that the
commit 1d6a9e7449 ("RDMA/core: Fix use-after-free when rename device name")
fixes.

The root cause is: the function ib_device_rename() renames the name with
lock. But in the function kobject_uevent(), this name is accessed without
lock protection at the same time.

The solution is to add the lock protection when this name is accessed in
the function kobject_uevent().

Fixes: 779e0bf476 ("RDMA/core: Do not indicate device ready when device enablement fails")
Link: https://patch.msgid.link/r/20250506151008.75701-1-yanjun.zhu@linux.dev
Reported-by: syzbot+e2ce9e275ecc70a30b72@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2ce9e275ecc70a30b72
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-05-22 14:29:39 +02:00
..
accel accel/ivpu: Increase state dump msg timeout 2025-05-18 08:24:54 +02:00
accessibility treewide: remove unnecessary <linux/version.h> inclusion 2024-08-12 18:36:44 +09:00
acpi ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls 2025-05-02 07:59:22 +02:00
amba ARM: 9416/1: amba: make amba_bustype constant 2024-09-04 15:01:17 +01:00
android binder: fix offset calculation in debug log 2025-05-09 09:50:29 +02:00
ata ata: libata-scsi: Fix ata_msense_control_ata_feature() 2025-05-02 07:59:09 +02:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-12 10:41:44 +01:00
auxdisplay auxdisplay: hd44780: Fix an API misuse in hd44780.c 2025-04-20 10:15:31 +02:00
base x86/its: Enable Indirect Target Selection mitigation 2025-05-18 08:24:59 +02:00
bcma PCI: Rename CRS Completion Status to RRS 2024-09-10 19:52:30 -05:00
block loop: Add sanity check for read/write_iter 2025-05-18 08:24:56 +02:00
bluetooth Bluetooth: btmtk: Remove the resetting step before downloading the fw 2025-05-18 08:24:57 +02:00
bus bus: mhi: host: Fix race between unprepare and queue_buf 2025-04-20 10:15:42 +02:00
cache cache: StarFive: Require a 64-bit system 2024-08-01 07:15:02 -07:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-10-17 19:47:15 -06:00
cdx cdx: Fix possible UAF error in driver_override_show() 2025-03-13 13:02:15 +01:00
char tpm: tis: Double the timeout B to 4s 2025-05-22 14:29:36 +02:00
clk clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() 2025-05-02 07:59:15 +02:00
clocksource clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() 2025-05-18 08:24:54 +02:00
comedi comedi: jr3_pci: Fix synchronous deletion of timer 2025-05-02 07:59:30 +02:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter counter: microchip-tcb-capture: Fix undefined counter channel state on probe 2025-04-07 10:08:36 +02:00
cpufreq cpufreq: Fix setting policy limits when frequency tables are used 2025-05-09 09:50:35 +02:00
cpuidle cpuidle: teo: Update documentation after previous changes 2025-01-23 17:22:49 +01:00
crypto crypto: ccp - Add support for PCI device 0x1134 2025-05-02 07:59:14 +02:00
cxl cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports 2025-05-02 07:59:08 +02:00
dax dax: delete a stale directory pmem 2024-12-05 14:02:13 +01:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq PM / devfreq: imx-bus: Use of_property_present() 2024-09-05 01:23:56 +09:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma dmaengine: dmatest: Fix dmatest waiting less when interrupted 2025-05-02 07:59:18 +02:00
dma-buf dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline() 2025-04-25 10:47:50 +02:00
dpll dpll: fix xa_alloc_cyclic() error handling 2025-03-28 22:03:27 +01:00
edac EDAC/altera: Set DDR and SDMMC interrupt mask before registration 2025-05-09 09:50:30 +02:00
eisa driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
extcon Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
firewire firewire: test: Fix potential null dereference in firewire kunit test 2025-02-08 09:57:57 +01:00
firmware firmware: arm_scmi: Fix timeout checks on polling path 2025-05-18 08:24:46 +02:00
fpga move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
fsi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
gnss [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpio gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment 2025-05-02 07:59:23 +02:00
gpu Revert "drm/amd: Stop evicting resources on APUs in suspend" 2025-05-22 14:29:37 +02:00
greybus greybus: gb-beagleplay: Add error handling for gb_greybus_init 2025-04-10 14:39:22 +02:00
hid HID: uclogic: Add NULL check in uclogic_input_configured() 2025-05-22 14:29:38 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-04-20 10:16:02 +02:00
hte hte: tegra-194: add missing MODULE_DESCRIPTION() macro 2024-06-19 12:24:03 -07:00
hv uio_hv_generic: Fix sysfs creation path for ring buffer 2025-05-22 14:29:36 +02:00
hwmon hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} 2025-04-10 14:39:31 +02:00
hwspinlock hwspinlock: qcom: implement bust operation 2024-05-29 12:52:26 -07:00
hwtracing coresight-etm4x: add isb() before reading the TRCSTATR 2025-04-10 14:39:22 +02:00
i2c i2c: imx-lpi2c: Fix clock count when probe defers 2025-05-09 09:50:31 +02:00
i3c i3c: master: svc: Add support for Nuvoton npcm845 i3c 2025-05-02 07:59:18 +02:00
idle intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly 2025-03-07 18:25:42 +01:00
iio iio: chemical: sps30: use aligned_s64 for timestamp 2025-05-22 14:29:37 +02:00
infiniband RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem 2025-05-22 14:29:39 +02:00
input Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 2025-05-18 08:24:51 +02:00
interconnect interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency 2024-12-05 14:02:37 +01:00
iommu iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) 2025-05-09 09:50:34 +02:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs 2025-05-09 09:50:31 +02:00
isdn move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
leds leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs 2025-04-20 10:15:44 +02:00
macintosh move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
mailbox mailbox: pcc: Always clear the platform ack interrupt first 2025-05-02 07:59:16 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:59:08 +02:00
md dm: add missing unlock on in dm_keyslot_evict() 2025-05-18 08:24:46 +02:00
media media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl() 2025-05-02 07:59:32 +02:00
memory memory: omap-gpmc: drop no compatible check 2025-04-10 14:39:31 +02:00
memstick memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove 2025-04-07 10:08:36 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-05 14:02:10 +01:00
mfd mfd: ene-kb3930: Fix a potential NULL pointer dereference 2025-04-20 10:15:44 +02:00
misc objtool, lkdtm: Obfuscate the do_nothing() pointer 2025-05-02 07:59:20 +02:00
mmc mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe 2025-05-09 09:50:32 +02:00
most Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
mtd mtd: rawnand: Add status chack in r852_ready() 2025-04-20 10:15:45 +02:00
mux mux: remove usage of the deprecated ida_simple_xx() API 2024-04-29 08:20:07 -07:00
net virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx 2025-05-22 14:29:38 +02:00
nfc move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ntb ntb_hw_amd: Add NTB PCI ID for new gen CPU 2025-05-02 07:59:20 +02:00
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 20:04:02 +01:00
nvme nvme: unblock ctrl state transition for firmware update 2025-05-18 08:24:57 +02:00
nvmem nvmem: imx-ocotp-ele: set word length to 1 2025-02-17 10:05:38 +01:00
of of: resolver: Fix device node refcount leakage in of_resolve_phandles() 2025-05-02 07:58:55 +02:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-08 09:57:10 +01:00
parisc parisc: pdc_stable: Constify struct kobj_type 2024-09-09 08:53:17 +02:00
parport serial: 8250_pci: Share WCH IDs with parport_serial driver 2025-02-21 14:01:25 +01:00
pci s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs 2025-05-18 08:24:47 +02:00
pcmcia move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
peci move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
perf perf/dwc_pcie: fix some unreleased resources 2025-04-20 10:15:11 +02:00
phy phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init 2025-05-02 07:59:18 +02:00
pinctrl pinctrl: imx: Return NULL if no group is matched and found 2025-05-09 09:50:36 +02:00
platform platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection 2025-05-22 14:29:35 +02:00
pmdomain pmdomain: amlogic: fix T7 ISP secpower 2025-03-28 22:03:31 +01:00
pnp driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
power power: supply: max77693: Fix wrong conversion of charge input threshold value 2025-04-10 14:39:20 +02:00
powercap powercap: call put_device() on an error path in powercap_register_control_type() 2025-03-22 12:54:14 -07:00
pps pps: Fix a use-after-free 2025-02-08 09:58:16 +01:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations 2025-05-09 09:50:47 +02:00
pwm pwm: fsl-ftm: Handle clk_get_rate() returning 0 2025-04-20 10:15:28 +02:00
rapidio rapidio: fix an API misues when rio_add_net() fails 2025-03-13 13:01:58 +01:00
ras RAS/AMD/FMPM: Get masked address 2025-04-25 10:47:56 +02:00
regulator objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() 2025-05-02 07:59:20 +02:00
remoteproc remoteproc: qcom_q6v5_mss: Handle platforms with one power domain 2025-04-10 14:39:19 +02:00
reset reset: rzg2l-usbphy-ctrl: Assign proper of node to the allocated device 2025-01-23 17:22:52 +01:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-05 14:02:25 +01:00
rtc rtc: pcf85063: do a SW reset if POR failed 2025-05-02 07:59:21 +02:00
s390 s390/tty: Fix a potential memory leak bug 2025-05-02 07:59:16 +02:00
sbus [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
scsi scsi: pm80xx: Set phy_attached to zero when device is gone 2025-05-02 07:59:26 +02:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-05 14:03:10 +01:00
siox Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 13:02:16 +01:00
soc soc: qcom: ice: introduce devm_of_qcom_ice_get 2025-05-02 07:58:52 +02:00
soundwire soundwire: slave: fix an OF node reference leak in soundwire slave device 2025-04-10 14:39:22 +02:00
spi spi: loopback-test: Do not split 1024-byte hexdumps 2025-05-22 14:29:38 +02:00
spmi spmi: pmic-arb: fix return path in for_each_available_child_of_node() 2024-12-09 10:41:03 +01:00
ssb driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
staging staging: axis-fifo: Correct handling of tx_fifo_depth for size validation 2025-05-18 08:24:51 +02:00
target scsi: target: spc: Fix RSOC parameter data header size 2025-04-20 10:15:17 +02:00
tc driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
tee tee: optee: Fix supplicant wait loop 2025-02-27 04:30:21 -08:00
thermal thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold 2025-04-20 10:16:00 +02:00
thunderbolt thunderbolt: Scan retimers after device router has been enumerated 2025-05-02 07:59:19 +02:00
tty serial: sifive: lock port in startup()/shutdown() callbacks 2025-05-02 07:59:11 +02:00
ufs scsi: ufs: core: Remove redundant query_complete trace 2025-05-09 09:50:43 +02:00
uio uio_hv_generic: Fix sysfs creation path for ring buffer 2025-05-22 14:29:36 +02:00
usb xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. 2025-05-22 14:29:37 +02:00
vdpa vdpa/mlx5: Fix oversized null mkey longer than 32bit 2025-04-20 10:15:42 +02:00
vfio vfio/pci: Align huge faults to order 2025-05-18 08:24:47 +02:00
vhost vhost-scsi: Fix vhost_scsi_send_status() 2025-05-02 07:59:01 +02:00
video backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() 2025-04-20 10:15:46 +02:00
virt drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl 2025-03-13 13:02:16 +01:00
virtio virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() 2025-05-22 14:29:38 +02:00
w1 w1: fix NULL pointer dereference in probe 2025-04-10 14:39:22 +02:00
watchdog watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe() 2025-02-08 09:57:54 +01:00
xen xenbus: Use kref to track req lifetime 2025-05-18 08:24:54 +02:00
zorro Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile leds: Init leds class earlier 2024-09-04 17:24:58 -05:00