kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/net/rds
History
Håkon Bugge 3996120058 rds: Fix NULL pointer dereference in __rds_rdma_map 
commit f3069c6d33 upstream.

This is a fix for syzkaller719569, where memory registration was
attempted without any underlying transport being loaded.

Analysis of the case reveals that it is the setsockopt() RDS_GET_MR
(2) and RDS_GET_MR_FOR_DEST (7) that are vulnerable.

Here is an example stack trace when the bug is hit:

BUG: unable to handle kernel NULL pointer dereference at 00000000000000c0
IP: __rds_rdma_map+0x36/0x440 [rds]
PGD 2f93d03067 P4D 2f93d03067 PUD 2f93d02067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: bridge stp llc tun rpcsec_gss_krb5 nfsv4
dns_resolver nfs fscache rds binfmt_misc sb_edac intel_powerclamp
coretemp kvm_intel kvm irqbypass crct10dif_pclmul c rc32_pclmul
ghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd
iTCO_wdt mei_me sg iTCO_vendor_support ipmi_si mei ipmi_devintf nfsd
shpchp pcspkr i2c_i801 ioatd ma ipmi_msghandler wmi lpc_ich mfd_core
auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4 mbcache jbd2
mgag200 i2c_algo_bit drm_kms_helper ixgbe syscopyarea ahci sysfillrect
sysimgblt libahci mdio fb_sys_fops ttm ptp libata sd_mod mlx4_core drm
crc32c_intel pps_core megaraid_sas i2c_core dca dm_mirror
dm_region_hash dm_log dm_mod
CPU: 48 PID: 45787 Comm: repro_set2 Not tainted 4.14.2-3.el7uek.x86_64 #2
Hardware name: Oracle Corporation ORACLE SERVER X5-2L/ASM,MOBO TRAY,2U, BIOS 31110000 03/03/2017
task: ffff882f9190db00 task.stack: ffffc9002b994000
RIP: 0010:__rds_rdma_map+0x36/0x440 [rds]
RSP: 0018:ffffc9002b997df0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff882fa2182580 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffc9002b997e40 RDI: ffff882fa2182580
RBP: ffffc9002b997e30 R08: 0000000000000000 R09: 0000000000000002
R10: ffff885fb29e3838 R11: 0000000000000000 R12: ffff882fa2182580
R13: ffff882fa2182580 R14: 0000000000000002 R15: 0000000020000ffc
FS:  00007fbffa20b700(0000) GS:ffff882fbfb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000c0 CR3: 0000002f98a66006 CR4: 00000000001606e0
Call Trace:
 rds_get_mr+0x56/0x80 [rds]
 rds_setsockopt+0x172/0x340 [rds]
 ? __fget_light+0x25/0x60
 ? __fdget+0x13/0x20
 SyS_setsockopt+0x80/0xe0
 do_syscall_64+0x67/0x1b0
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7fbff9b117f9
RSP: 002b:00007fbffa20aed8 EFLAGS: 00000293 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000000c84a4 RCX: 00007fbff9b117f9
RDX: 0000000000000002 RSI: 0000400000000114 RDI: 000000000000109b
RBP: 00007fbffa20af10 R08: 0000000000000020 R09: 00007fbff9dd7860
R10: 0000000020000ffc R11: 0000000000000293 R12: 0000000000000000
R13: 00007fbffa20b9c0 R14: 00007fbffa20b700 R15: 0000000000000021

Code: 41 56 41 55 49 89 fd 41 54 53 48 83 ec 18 8b 87 f0 02 00 00 48
89 55 d0 48 89 4d c8 85 c0 0f 84 2d 03 00 00 48 8b 87 00 03 00 00 <48>
83 b8 c0 00 00 00 00 0f 84 25 03 00 0 0 48 8b 06 48 8b 56 08

The fix is to check the existence of an underlying transport in
__rds_rdma_map().

Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-03-03 15:52:35 +00:00
..
af_rds.c rds: Make rds_sock_lock BH rather than IRQ safe. 2012-01-24 17:03:44 -05:00
bind.c net: replace macros net_random and net_srandom with direct calls to prandom 2014-01-14 15:15:25 -08:00
cong.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
connection.c RDS: fix race condition when sending a message on unbound socket 2016-01-04 17:20:35 +00:00
ib.c rds: prevent dereference of a NULL device 2013-12-27 12:33:58 -05:00
ib.h net: rds: use this_cpu_* per-cpu helper 2012-11-19 18:59:44 -05:00
ib_cm.c IB/rds: suppress incompatible protocol when version is known 2012-12-26 15:17:37 -08:00
ib_rdma.c rds: rds_ib_device.refcount overflow 2015-08-11 09:57:26 +01:00
ib_recv.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
ib_ring.c RDS/IW+IB: Set recv ring low water mark to 1/2 full. 2009-04-09 17:21:14 -07:00
ib_send.c net: rds: Use time_after() for time comparison 2014-05-18 21:24:52 -04:00
ib_stats.c RDS: Move atomic stats from general to ib-specific area 2010-09-08 18:12:20 -07:00
ib_sysctl.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
info.c rds: fix an integer overflow test in rds_info_getsockopt() 2015-08-27 14:15:44 +01:00
info.h RDS: Info and stats 2009-02-26 23:39:25 -08:00
iw.c rds: prevent dereference of a NULL device in rds_iw_laddr_check 2014-03-31 16:25:52 -04:00
iw.h net: remove interrupt.h inclusion from netdevice.h 2011-06-06 22:55:11 -07:00
iw_cm.c RDS: use gfp flags from caller in conn_alloc() 2012-03-22 19:29:58 -04:00
iw_rdma.c rds: avoid potential stack overflow 2015-03-24 10:25:57 +00:00
iw_recv.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
iw_ring.c RDS/IW+IB: Set recv ring low water mark to 1/2 full. 2009-04-09 17:21:14 -07:00
iw_send.c net: rds: Use time_after() for time comparison 2014-05-18 21:24:52 -04:00
iw_stats.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu 2009-09-15 09:39:44 -07:00
iw_sysctl.c rds: remove the unneed NULL checking 2014-05-09 15:59:45 -04:00
Kconfig net/rds: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:02 -08:00
loop.c RDS: use gfp flags from caller in conn_alloc() 2012-03-22 19:29:58 -04:00
loop.h RDS: loopback 2009-02-26 23:39:26 -08:00
Makefile Net: rds: Makefile: Remove deprecated items 2010-11-22 08:16:15 -08:00
message.c rds: simplify a warning message 2013-03-04 14:12:07 -05:00
page.c net: Fix (nearly-)kernel-doc comments for various functions 2012-07-10 23:13:45 -07:00
rdma.c rds: Fix NULL pointer dereference in __rds_rdma_map 2018-03-03 15:52:35 +00:00
rdma_transport.c RDS/RDMA: Replace comma with semicolon 2014-05-30 17:48:58 -07:00
rdma_transport.h rds: make local functions/variables static 2010-10-21 04:26:39 -07:00
rds.h net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
recv.c rds: fix an infoleak in rds_inc_info_copy 2016-08-22 22:38:28 +01:00
send.c RDS: fix race condition when sending a message on unbound socket 2016-01-04 17:20:35 +00:00
stats.c net/rds: zero last byte for strncpy 2013-03-08 00:35:44 -05:00
sysctl.c net: rds: use correct size for max unacked packets and bytes 2015-03-02 15:04:42 +00:00
tcp.c net: Fix files explicitly needing to include module.h 2011-10-31 19:30:28 -04:00
tcp.h net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
tcp_connect.c rds: Don't disable BH on BH context 2012-08-22 22:52:04 -07:00
tcp_listen.c rds/tcp_listen: Replace comma with semicolon 2014-05-30 17:48:58 -07:00
tcp_recv.c RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv 2015-12-09 11:40:51 +00:00
tcp_send.c arch: Mass conversion of smp_mb__*() 2014-04-18 14:20:48 +02:00
tcp_stats.c net: rds: fix const array syntax 2011-07-01 16:16:19 -07:00
threads.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
transport.c RDS: have sockets get transport module references 2010-09-08 18:16:47 -07:00