linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00

Linux kernel source tree

Go to file

Leon Romanovsky 2923948ffe RDMA/ucma: Protect mc during concurrent multicast leaves commit `36e8169ec9` upstream. Partially revert the commit mentioned in the Fixes line to make sure that allocation and erasing multicast struct are locked. BUG: KASAN: use-after-free in ucma_cleanup_multicast drivers/infiniband/core/ucma.c:491 [inline] BUG: KASAN: use-after-free in ucma_destroy_private_ctx+0x914/0xb70 drivers/infiniband/core/ucma.c:579 Read of size 8 at addr ffff88801bb74b00 by task syz-executor.1/25529 CPU: 0 PID: 25529 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 ucma_cleanup_multicast drivers/infiniband/core/ucma.c:491 [inline] ucma_destroy_private_ctx+0x914/0xb70 drivers/infiniband/core/ucma.c:579 ucma_destroy_id+0x1e6/0x280 drivers/infiniband/core/ucma.c:614 ucma_write+0x25c/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xae0 fs/read_write.c:588 ksys_write+0x1ee/0x250 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Currently the xarray search can touch a concurrently freeing mc as the xa_for_each() is not surrounded by any lock. Rather than hold the lock for a full scan hold it only for the effected items, which is usually an empty list. Fixes: `95fe51096b` ("RDMA/ucma: Remove mc_list and rely on xarray") Link: https://lore.kernel.org/r/1cda5fabb1081e8d16e39a48d3a4f8160cea88b8.1642491047.git.leonro@nvidia.com Reported-by: syzbot+e3f96c43d19782dd14a7@syzkaller.appspotmail.com Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Maor Gottlieb <maorg@nvidia.com> Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-08 18:34:06 +01:00
arch	KVM: arm64: Stop handle_exit() from handling HVC twice when an SError occurs	2022-02-08 18:34:06 +01:00
block	block: bio-integrity: Advance seed correctly for larger interval sizes	2022-02-08 18:34:05 +01:00
certs	certs: Add support for using elliptic curve keys for signing modules	2021-08-23 19:55:42 +03:00
crypto	crypto: jitter - consider 32 LSB for APT	2022-01-27 11:04:31 +01:00
Documentation	Revert "fbcon: Disable accelerated scrolling"	2022-02-08 18:34:06 +01:00
drivers	RDMA/ucma: Protect mc during concurrent multicast leaves	2022-02-08 18:34:06 +01:00
fs	Revert "fs/9p: search open fids first"	2022-02-08 18:34:04 +01:00
include	mm/pgtable: define pte_index so that preprocessor could recognize it	2022-02-08 18:34:05 +01:00
init	init: make unknown command line param message clearer	2021-11-18 19:17:11 +01:00
ipc	ipc/sem: do not sleep with a spin lock held	2022-02-08 18:34:03 +01:00
kernel	audit: improve audit queue handling when "audit=1" on cmdline	2022-02-08 18:34:03 +01:00
lib	lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test	2022-01-27 11:05:44 +01:00
LICENSES	LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes"	2021-07-15 06:31:24 -06:00
mm	mm/kmemleak: avoid scanning potential huge holes	2022-02-08 18:34:05 +01:00
net	mptcp: fix msk traversal in mptcp_nl_cmd_set_flags()	2022-02-08 18:34:06 +01:00
samples	samples: bpf: Fix 'unknown warning group' build warning on Clang	2022-01-27 11:03:29 +01:00
scripts	scripts: sphinx-pre-install: Fix ctex support on Debian	2022-01-27 11:05:44 +01:00
security	selinux: fix double free of cond_list on error paths	2022-02-08 18:34:02 +01:00
sound	ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows	2022-02-08 18:34:04 +01:00
tools	selftests: mptcp: fix ipv6 routing setup	2022-02-05 12:38:56 +01:00
usr	usr/include/Makefile: add linux/nfc.h to the compile-test coverage	2022-02-01 17:27:15 +01:00
virt	Revert "KVM: SVM: avoid infinite loop on NPF from bad address"	2022-02-01 17:27:01 +01:00
.clang-format	clang-format: Update with the latest for_each macro list	2021-05-12 23:32:39 +02:00
.cocciconfig
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	.gitignore: ignore only top-level modules.builtin	2021-05-02 00:43:35 +09:00
.mailmap	mailmap: add Andrej Shadura	2021-10-18 20:22:03 -10:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Daniel Drake to credits	2021-09-21 08:34:58 +03:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	drm fixes for 5.15 final	2021-10-28 12:17:01 -07:00
Makefile	Linux 5.15.21	2022-02-05 19:21:09 +01:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.