kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Shay Drory bd538f2f13 RDMA/core: Don't access cm_id after its destruction 
[ Upstream commit 889d916b6f ]

restrack should only be attached to a cm_id while the ID has a valid
device pointer. It is set up when the device is first loaded, but not
cleared when the device is removed. There is also two copies of the device
pointer, one private and one in the public API, and these were left out of
sync.

Make everything go to NULL together and manipulate restrack right around
the device assignments.

Found by syzcaller:
BUG: KASAN: wild-memory-access in __list_del include/linux/list.h:112 [inline]
BUG: KASAN: wild-memory-access in __list_del_entry include/linux/list.h:135 [inline]
BUG: KASAN: wild-memory-access in list_del include/linux/list.h:146 [inline]
BUG: KASAN: wild-memory-access in cma_cancel_listens drivers/infiniband/core/cma.c:1767 [inline]
BUG: KASAN: wild-memory-access in cma_cancel_operation drivers/infiniband/core/cma.c:1795 [inline]
BUG: KASAN: wild-memory-access in cma_cancel_operation+0x1f4/0x4b0 drivers/infiniband/core/cma.c:1783
Write of size 8 at addr dead000000000108 by task syz-executor716/334

CPU: 0 PID: 334 Comm: syz-executor716 Not tainted 5.11.0+ #271
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xbe/0xf9 lib/dump_stack.c:120
 __kasan_report mm/kasan/report.c:400 [inline]
 kasan_report.cold+0x5f/0xd5 mm/kasan/report.c:413
 __list_del include/linux/list.h:112 [inline]
 __list_del_entry include/linux/list.h:135 [inline]
 list_del include/linux/list.h:146 [inline]
 cma_cancel_listens drivers/infiniband/core/cma.c:1767 [inline]
 cma_cancel_operation drivers/infiniband/core/cma.c:1795 [inline]
 cma_cancel_operation+0x1f4/0x4b0 drivers/infiniband/core/cma.c:1783
 _destroy_id+0x29/0x460 drivers/infiniband/core/cma.c:1862
 ucma_close_id+0x36/0x50 drivers/infiniband/core/ucma.c:185
 ucma_destroy_private_ctx+0x58d/0x5b0 drivers/infiniband/core/ucma.c:576
 ucma_close+0x91/0xd0 drivers/infiniband/core/ucma.c:1797
 __fput+0x169/0x540 fs/file_table.c:280
 task_work_run+0xb7/0x100 kernel/task_work.c:140
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0x7da/0x17f0 kernel/exit.c:825
 do_group_exit+0x9e/0x190 kernel/exit.c:922
 __do_sys_exit_group kernel/exit.c:933 [inline]
 __se_sys_exit_group kernel/exit.c:931 [inline]
 __x64_sys_exit_group+0x2d/0x30 kernel/exit.c:931
 do_syscall_64+0x2d/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 255d0c14b3 ("RDMA/cma: rdma_bind_addr() leaks a cma_dev reference count")
Link: https://lore.kernel.org/r/3352ee288fe34f2b44220457a29bfc0548686363.1620711734.git.leonro@nvidia.com
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2021-05-26 12:06:48 +02:00
..
accessibility speakup: fix uninitialized flush_lock 2020-12-30 11:53:44 +01:00
acpi ACPI: scan: Fix a memory leak in an error handling path 2021-05-19 10:13:13 +02:00
amba amba: Fix resource leak for drivers without .remove 2021-03-04 11:38:02 +01:00
android binder: add flag to clear buffer on txn complete 2020-12-30 11:54:09 +01:00
ata ata: libahci_platform: fix IRQ check 2021-05-14 09:50:24 +02:00
atm atm: idt77252: fix null-ptr-dereference 2021-03-30 14:31:50 +02:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-03-04 11:38:00 +01:00
base PM: runtime: Fix unpaired parent child_count for force_resume 2021-05-19 10:12:51 +02:00
bcma bcma: use semicolons rather than commas to separate statements 2020-10-01 16:23:50 +03:00
block nbd: Fix NULL pointer in flush_workqueue 2021-05-19 10:13:14 +02:00
bluetooth Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip. 2021-05-19 10:12:54 +02:00
bus bus: qcom: Put child node before return 2021-05-14 09:50:13 +02:00
cdrom gdrom: use bdev_check_media_change 2020-09-10 09:32:31 -06:00
char tpm, tpm_tis: Reserve locality in tpm_tis_resume() 2021-05-19 10:12:51 +02:00
clk clk: exynos7: Mark aclk_fsys1_200 as critical 2021-05-19 10:13:19 +02:00
clocksource clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940 2021-05-19 10:13:18 +02:00
connector connector: simplify the return expression of cn_add_callback() 2020-09-21 13:48:29 -07:00
counter counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register 2021-03-25 09:04:16 +01:00
cpufreq cpufreq: intel_pstate: Use HWP if enabled by platform firmware 2021-05-19 10:12:51 +02:00
cpuidle cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration 2021-05-14 09:50:16 +02:00
crypto crypto: ccp: Free SEV device if SEV init fails 2021-05-19 10:12:58 +02:00
dax device-dax: Fix default return code of range_parse() 2021-03-04 11:38:15 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: Use more accurate returned new_freq as resume_freq 2021-05-14 09:50:15 +02:00
dio maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault 2020-06-17 10:57:41 -07:00
dma dmaengine: dw-edma: Fix crash on loading/unloading driver 2021-05-22 11:40:52 +02:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-01-12 20:18:24 +01:00
edac EDAC/amd64: Do not load on family 0x15, model 0x13 2021-03-07 12:34:08 +01:00
eisa treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
extcon extcon: arizona: Fix various races on driver unbind 2021-05-11 14:47:24 +02:00
firewire firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-04-07 15:00:11 +02:00
firmware firmware: arm_scpi: Prevent the ternary sign expansion bug 2021-05-26 12:06:47 +02:00
fpga fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER 2021-05-14 09:50:06 +02:00
fsi fsi: Aspeed: Add mutex to protect HW access 2020-12-30 11:53:46 +01:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 2021-05-22 11:40:54 +02:00
gpu drm/amd/display: Fix two cursor duplication when using overlay 2021-05-22 11:40:54 +02:00
greybus drivers/greybus: Use kobj_to_dev() 2020-09-04 18:06:01 +02:00
hid HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE 2021-05-14 09:50:33 +02:00
hsi HSI: core: fix resource leaks in hsi_add_client_from_dt() 2021-05-14 09:50:28 +02:00
hv Drivers: hv: vmbus: Increase wait time for VMbus unload 2021-05-14 09:50:21 +02:00
hwmon hwmon: (occ) Fix poll rate limiting 2021-05-19 10:13:13 +02:00
hwspinlock hwspinlock: qcom: Allow mmio usage in addition to syscon 2020-07-13 22:29:28 -07:00
hwtracing coresight: Do not scan for graph if none is present 2021-05-19 10:12:55 +02:00
i2c i2c: mediatek: Fix send master code at more than 1MHz 2021-05-19 10:13:19 +02:00
i3c Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" 2021-05-14 09:50:05 +02:00
ide ide/falconide: Fix module unload 2021-03-04 11:38:21 +01:00
idle intel_idle: Build fix 2020-12-03 10:00:23 +01:00
iio iio: tsl2583: Fix division by a zero lux_val 2021-05-19 10:13:16 +02:00
infiniband RDMA/core: Don't access cm_id after its destruction 2021-05-26 12:06:48 +02:00
input Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state 2021-05-22 11:40:52 +02:00
interconnect interconnect: core: fix error return code of icc_link_destroy() 2021-04-16 11:43:19 +02:00
iommu iommu/vt-d: Remove WO permissions on second-level paging entries 2021-05-19 10:13:17 +02:00
ipack treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
irqchip irqchip/gic-v3: Fix OF_BAD_ADDR error handling 2021-05-14 09:50:15 +02:00
isdn isdn: capi: fix mismatched prototypes 2021-05-22 11:40:52 +02:00
leds leds: trigger: fix potential deadlock with libata 2021-02-03 23:28:41 +01:00
lightnvm lightnvm: fix memory leak when submit fails 2021-01-27 11:55:22 +01:00
macintosh macintosh/adb-iop: Use big-endian autopoll mask 2021-03-04 11:37:42 +01:00
mailbox mailbox: sprd: Introduce refcnt when clients requests/free channels 2021-05-14 09:50:27 +02:00
mcb drivers: mcb: use symbol namespaces 2019-11-03 19:54:53 +01:00
md md: Fix missing unused status line of /proc/mdstat 2021-05-14 09:49:59 +02:00
media media: v4l2-ctrls.c: fix race condition in hdl->requests list 2021-05-14 09:50:25 +02:00
memory memory: samsung: exynos5422-dmc: handle clk_set_parent() failure 2021-05-14 09:50:19 +02:00
memstick memstick: r592: Fix error return in r592_probe() 2020-12-30 11:53:34 +01:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2020-10-26 16:57:18 -04:00
mfd mfd: stm32-timers: Avoid clearing auto reload register 2021-05-14 09:50:27 +02:00
misc kgdb: fix gcc-11 warning on indentation 2021-05-22 11:40:51 +02:00
mmc mmc: sdhci-brcmstb: Remove CQE quirk 2021-05-11 14:47:26 +02:00
most drivers: most: add character device interface driver 2020-09-07 15:16:26 +02:00
mtd mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init 2021-05-14 09:50:15 +02:00
mux treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
net net: stmmac: Do not enable RX FIFO overflow interrupts 2021-05-22 11:40:55 +02:00
nfc nfc: pn533: prevent potential memory corruption 2021-05-14 09:50:32 +02:00
ntb Bug fixes for v5.10 2020-10-25 11:12:31 -07:00
nubus nubus: Remove cast to void pointer 2019-10-21 09:08:15 +02:00
nvdimm libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC 2021-04-21 13:00:55 +02:00
nvme nvmet: remove unsupported command noise 2021-05-22 11:40:54 +02:00
nvmem drivers: nvmem: Fix voltage settings for QTI qfprom-efuse 2021-05-14 09:50:14 +02:00
of of: overlay: fix for_each_child.cocci warnings 2021-05-14 09:50:24 +02:00
opp opp: Correct debug message in _opp_add_static_v2() 2021-03-04 11:37:27 +01:00
oprofile module: Fix up module_notifier return values 2020-09-01 09:58:03 +02:00
parisc dma-mapping: split <linux/dma-mapping.h> 2020-10-06 07:07:03 +02:00
parport treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pci PCI: tegra: Fix runtime PM imbalance in pex_ep_event_pex_rst_deassert() 2021-05-22 11:40:52 +02:00
pcmcia dma-mapping: remove DMA_MASK_NONE 2020-09-25 06:12:15 +02:00
perf perf/arm_pmu_platform: Fix error handling 2021-05-11 14:47:19 +02:00
phy phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally 2021-05-14 09:50:13 +02:00
pinctrl pinctrl: samsung: use 'int' for register masks in Exynos 2021-05-19 10:12:55 +02:00
platform platform/chrome: cros_ec_typec: Add DP mode check 2021-05-22 11:40:53 +02:00
pnp PNP: fix kernel-doc markups 2020-10-27 19:23:04 +01:00
power power: supply: bq25980: Move props from battery node 2021-05-14 09:50:25 +02:00
powercap Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2020-11-10 10:02:31 -08:00
pps treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ps3 powerpc/ps3: use dma_mapping_error() 2020-12-30 11:53:53 +01:00
ptp ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation 2021-04-10 13:36:09 +02:00
pwm pwm: atmel: Fix duty cycle calculation in .get_state() 2021-05-19 10:13:04 +02:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2020-10-16 11:11:22 -07:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-14 08:42:12 +02:00
regulator regulator: bd9576: Fix return from bd957x_probe() 2021-05-14 09:50:10 +02:00
remoteproc remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader 2021-05-19 10:13:01 +02:00
reset ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
rpmsg rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() 2021-05-19 10:13:02 +02:00
rtc rtc: ds1307: Fix wday settings for rx8130 2021-05-19 10:13:05 +02:00
s390 s390/zcrypt: fix zcard and zqueue hot-unplug memleak 2021-05-11 14:47:11 +02:00
sbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
scsi scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() 2021-05-26 12:06:48 +02:00
sfi treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
sh iomap: constify ioreadX() iomem argument (as in generic implementation) 2020-08-14 19:56:57 -07:00
siox siox: Use the correct style for SPDX License Identifier 2020-01-14 21:46:53 +01:00
slimbus slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() 2020-12-30 11:53:47 +01:00
soc soc: aspeed: fix a ternary sign expansion bug 2021-05-14 09:50:21 +02:00
soundwire soundwire: stream: fix memory leak in stream config error path 2021-05-14 09:50:14 +02:00
spi spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails 2021-05-14 09:50:20 +02:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-03-04 11:38:40 +01:00
ssb ssb: Remove meaningless jump label to simplify the code 2020-09-21 16:01:35 +03:00
staging media: rkvdec: Remove of_match_ptr() 2021-05-19 10:13:19 +02:00
target scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found 2021-05-22 11:40:54 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: amdtee: unload TA only when its refcount becomes 0 2021-05-26 12:06:47 +02:00
thermal thermal/drivers/tsens: Fix missing put_device error 2021-05-19 10:13:03 +02:00
thunderbolt thunderbolt: Fix off by one in tb_port_find_retimer() 2021-04-14 08:42:03 +02:00
tty serial: omap: fix rs485 half-duplex filtering 2021-05-14 09:50:21 +02:00
uio uio: Fix use-after-free in uio_unregister_device() 2020-11-09 18:54:30 +01:00
usb usb: sl811-hcd: improve misleading indentation 2021-05-22 11:40:51 +02:00
vdpa vdpa/mlx5: Set err = -ENOMEM in case dma_map_sg_attrs fails 2021-04-28 13:39:59 +02:00
vfio vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer 2021-05-14 09:50:26 +02:00
vhost vhost-vdpa: fix vm_flags for virtqueue doorbell mapping 2021-05-11 14:47:12 +02:00
video backlight: qcom-wled: Fix FSC update issue for WLED5 2021-05-11 14:47:25 +02:00
virt nitro_enclaves: Fix stale file descriptors on failed usercopy 2021-05-11 14:47:11 +02:00
virtio virtio_ring: Fix two use after free bugs 2020-12-30 11:54:00 +01:00
visorbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
vlynq treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 102 2019-05-24 17:39:00 +02:00
vme treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
w1 w1: w1_therm: Fix conversion result for negative temperatures 2021-03-04 11:37:18 +01:00
watchdog watchdog: mei_wdt: request stop on unregister 2021-03-04 11:38:36 +01:00
xen xen/gntdev: fix gntdev_mmap() error exit path 2021-05-19 10:13:16 +02:00
zorro zorro: Fix address space collision message with RAM expansion boards 2020-08-26 13:26:52 +02:00
Kconfig virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
Makefile vdpa: mlx5: fix vdpa/vhost dependencies 2020-12-02 04:09:56 -05:00