Leon Romanovsky c5f3efad2a RDMA/ucma: Check AF family prior resolving address ... commit 2975d5de64 upstream. Garbage supplied by user will cause to UCMA module provide zero memory size for memcpy(), because it wasn't checked, it will produce unpredictable results in rdma_resolve_addr(). [ 42.873814] BUG: KASAN: null-ptr-deref in rdma_resolve_addr+0xc8/0xfb0 [ 42.874816] Write of size 28 at addr 00000000000000a0 by task resaddr/1044 [ 42.876765] [ 42.876960] CPU: 1 PID: 1044 Comm: resaddr Not tainted 4.16.0-rc1-00057-gaa56a5293d7e #34 [ 42.877840] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 [ 42.879691] Call Trace: [ 42.880236] dump_stack+0x5c/0x77 [ 42.880664] kasan_report+0x163/0x380 [ 42.881354] ? rdma_resolve_addr+0xc8/0xfb0 [ 42.881864] memcpy+0x34/0x50 [ 42.882692] rdma_resolve_addr+0xc8/0xfb0 [ 42.883366] ? deref_stack_reg+0x88/0xd0 [ 42.883856] ? vsnprintf+0x31a/0x770 [ 42.884686] ? rdma_bind_addr+0xc40/0xc40 [ 42.885327] ? num_to_str+0x130/0x130 [ 42.885773] ? deref_stack_reg+0x88/0xd0 [ 42.886217] ? __read_once_size_nocheck.constprop.6+0x10/0x10 [ 42.887698] ? unwind_get_return_address_ptr+0x50/0x50 [ 42.888302] ? replace_slot+0x147/0x170 [ 42.889176] ? delete_node+0x12c/0x340 [ 42.890223] ? __radix_tree_lookup+0xa9/0x160 [ 42.891196] ? ucma_resolve_ip+0xb7/0x110 [ 42.891917] ucma_resolve_ip+0xb7/0x110 [ 42.893003] ? ucma_resolve_addr+0x190/0x190 [ 42.893531] ? _copy_from_user+0x5e/0x90 [ 42.894204] ucma_write+0x174/0x1f0 [ 42.895162] ? ucma_resolve_route+0xf0/0xf0 [ 42.896309] ? dequeue_task_fair+0x67e/0xd90 [ 42.897192] ? put_prev_entity+0x7d/0x170 [ 42.897870] ? ring_buffer_record_is_on+0xd/0x20 [ 42.898439] ? tracing_record_taskinfo_skip+0x20/0x50 [ 42.899686] __vfs_write+0xc4/0x350 [ 42.900142] ? kernel_read+0xa0/0xa0 [ 42.900602] ? firmware_map_remove+0xdf/0xdf [ 42.901135] ? do_task_dead+0x5d/0x60 [ 42.901598] ? do_exit+0xcc6/0x1220 [ 42.902789] ? __fget+0xa8/0xf0 [ 42.903190] vfs_write+0xf7/0x280 [ 42.903600] SyS_write+0xa1/0x120 [ 42.904206] ? SyS_read+0x120/0x120 [ 42.905710] ? compat_start_thread+0x60/0x60 [ 42.906423] ? SyS_read+0x120/0x120 [ 42.908716] do_syscall_64+0xeb/0x250 [ 42.910760] entry_SYSCALL_64_after_hwframe+0x21/0x86 [ 42.912735] RIP: 0033:0x7f138b0afe99 [ 42.914734] RSP: 002b:00007f138b799e98 EFLAGS: 00000287 ORIG_RAX: 0000000000000001 [ 42.917134] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f138b0afe99 [ 42.919487] RDX: 000000000000002e RSI: 0000000020000c40 RDI: 0000000000000004 [ 42.922393] RBP: 00007f138b799ec0 R08: 00007f138b79a700 R09: 0000000000000000 [ 42.925266] R10: 00007f138b79a700 R11: 0000000000000287 R12: 00007f138b799fc0 [ 42.927570] R13: 0000000000000000 R14: 00007ffdbae757c0 R15: 00007f138b79a9c0 [ 42.930047] [ 42.932681] Disabling lock debugging due to kernel taint [ 42.934795] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0 [ 42.936939] IP: memcpy_erms+0x6/0x10 [ 42.938864] PGD 80000001bea92067 P4D 80000001bea92067 PUD 1bea96067 PMD 0 [ 42.941576] Oops: 0002 [#1] SMP KASAN PTI [ 42.943952] CPU: 1 PID: 1044 Comm: resaddr Tainted: G B 4.16.0-rc1-00057-gaa56a5293d7e #34 [ 42.946964] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 [ 42.952336] RIP: 0010:memcpy_erms+0x6/0x10 [ 42.954707] RSP: 0018:ffff8801c8b479c8 EFLAGS: 00010286 [ 42.957227] RAX: 00000000000000a0 RBX: ffff8801c8b47ba0 RCX: 000000000000001c [ 42.960543] RDX: 000000000000001c RSI: ffff8801c8b47bbc RDI: 00000000000000a0 [ 42.963867] RBP: ffff8801c8b47b60 R08: 0000000000000000 R09: ffffed0039168ed1 [ 42.967303] R10: 0000000000000001 R11: ffffed0039168ed0 R12: ffff8801c8b47bbc [ 42.970685] R13: 00000000000000a0 R14: 1ffff10039168f4a R15: 0000000000000000 [ 42.973631] FS: 00007f138b79a700(0000) GS:ffff8801e5d00000(0000) knlGS:0000000000000000 [ 42.976831] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.979239] CR2: 00000000000000a0 CR3: 00000001be908002 CR4: 00000000003606a0 [ 42.982060] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.984877] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.988033] Call Trace: [ 42.990487] rdma_resolve_addr+0xc8/0xfb0 [ 42.993202] ? deref_stack_reg+0x88/0xd0 [ 42.996055] ? vsnprintf+0x31a/0x770 [ 42.998707] ? rdma_bind_addr+0xc40/0xc40 [ 43.000985] ? num_to_str+0x130/0x130 [ 43.003410] ? deref_stack_reg+0x88/0xd0 [ 43.006302] ? __read_once_size_nocheck.constprop.6+0x10/0x10 [ 43.008780] ? unwind_get_return_address_ptr+0x50/0x50 [ 43.011178] ? replace_slot+0x147/0x170 [ 43.013517] ? delete_node+0x12c/0x340 [ 43.016019] ? __radix_tree_lookup+0xa9/0x160 [ 43.018755] ? ucma_resolve_ip+0xb7/0x110 [ 43.021270] ucma_resolve_ip+0xb7/0x110 [ 43.023968] ? ucma_resolve_addr+0x190/0x190 [ 43.026312] ? _copy_from_user+0x5e/0x90 [ 43.029384] ucma_write+0x174/0x1f0 [ 43.031861] ? ucma_resolve_route+0xf0/0xf0 [ 43.034782] ? dequeue_task_fair+0x67e/0xd90 [ 43.037483] ? put_prev_entity+0x7d/0x170 [ 43.040215] ? ring_buffer_record_is_on+0xd/0x20 [ 43.042990] ? tracing_record_taskinfo_skip+0x20/0x50 [ 43.045595] __vfs_write+0xc4/0x350 [ 43.048624] ? kernel_read+0xa0/0xa0 [ 43.051604] ? firmware_map_remove+0xdf/0xdf [ 43.055379] ? do_task_dead+0x5d/0x60 [ 43.058000] ? do_exit+0xcc6/0x1220 [ 43.060783] ? __fget+0xa8/0xf0 [ 43.063133] vfs_write+0xf7/0x280 [ 43.065677] SyS_write+0xa1/0x120 [ 43.068647] ? SyS_read+0x120/0x120 [ 43.071179] ? compat_start_thread+0x60/0x60 [ 43.074025] ? SyS_read+0x120/0x120 [ 43.076705] do_syscall_64+0xeb/0x250 [ 43.079006] entry_SYSCALL_64_after_hwframe+0x21/0x86 [ 43.081606] RIP: 0033:0x7f138b0afe99 [ 43.083679] RSP: 002b:00007f138b799e98 EFLAGS: 00000287 ORIG_RAX: 0000000000000001 [ 43.086802] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f138b0afe99 [ 43.089989] RDX: 000000000000002e RSI: 0000000020000c40 RDI: 0000000000000004 [ 43.092866] RBP: 00007f138b799ec0 R08: 00007f138b79a700 R09: 0000000000000000 [ 43.096233] R10: 00007f138b79a700 R11: 0000000000000287 R12: 00007f138b799fc0 [ 43.098913] R13: 0000000000000000 R14: 00007ffdbae757c0 R15: 00007f138b79a9c0 [ 43.101809] Code: 90 90 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 [ 43.107950] RIP: memcpy_erms+0x6/0x10 RSP: ffff8801c8b479c8 Reported-by: <syzbot+1d8c43206853b369d00c@syzkaller.appspotmail.com> Fixes: 7521663857 ("RDMA/cma: Export rdma cm interface to userspace") Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Reviewed-by: Sean Hefty <sean.hefty@intel.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-04-08 11:51:58 +02:00
..
accessibility
acpi	ACPI, PCI, irq: remove redundant check for null string pointer	2018-04-08 11:51:56 +02:00
amba
android	binder: add missing binder_unlock()	2018-02-28 10:17:23 +01:00
ata	libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version	2018-03-28 18:40:14 +02:00
atm	atm: horizon: Fix irq release error	2017-12-16 10:33:55 +01:00
auxdisplay
base	drivers: base: cacheinfo: fix boot error message when acpi is enabled	2018-01-31 12:06:08 +01:00
bcma
block	mtip32xx: use runtime tag to initialize command header	2018-03-24 10:58:44 +01:00
bluetooth	Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174	2018-03-28 18:40:13 +02:00
bus	sunxi-rsb: Include OF based modalias in device uevent	2018-01-10 09:27:09 +01:00
cdrom
char	ipmi/watchdog: fix wdog hang on panic waiting for ipmi response	2018-03-24 10:58:45 +01:00
clk	clk: bcm2835: Protect sections updating shared registers	2018-03-28 18:40:13 +02:00
clocksource	clockevents/drivers/cs5535: Improve resilience to spurious interrupts	2017-10-27 10:23:17 +02:00
connector
cpufreq	cpufreq/sh: Replace racy task affinity logic	2018-03-24 10:58:41 +01:00
cpuidle	cpuidle: fix broadcast control when broadcast can not be entered	2017-12-25 14:22:15 +01:00
crypto	crypto: s5p-sss - Fix kernel Oops in AES-ECB mode	2018-02-25 11:03:55 +01:00
dca
devfreq	PM / devfreq: Propagate error from devfreq_add_device()	2018-02-22 15:44:58 +01:00
dio
dma	dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63	2018-03-24 10:58:48 +01:00
dma-buf
edac	EDAC, octeon: Fix an uninitialized variable warning	2018-02-16 20:09:47 +01:00
eisa
extcon	extcon: palmas: Check the parent instance to prevent the NULL	2017-11-21 09:21:18 +01:00
firewire
firmware	efi/esrt: Cleanup bad memory map log messages	2017-12-20 10:04:56 +01:00
fmc
fpga
gpio	gpio: xgene: mark PM functions as __maybe_unused	2018-02-25 11:03:50 +01:00
gpu	drm: udl: Properly check framebuffer mmap offsets	2018-03-28 18:40:15 +02:00
hid	HID: elo: clear BTN_LEFT mapping	2018-03-22 09:23:27 +01:00
hsi	HSI: ssi_protocol: double free in ssip_pn_xmit()	2018-03-24 10:58:42 +01:00
hv	Drivers: hv: vmbus: fix build warning	2018-02-25 11:03:46 +01:00
hwmon	driver: (adm1275) set the m,b and R coefficients correctly for power	2018-03-22 09:23:22 +01:00
hwspinlock
hwtracing	coresight: Fix disabling of CoreSight TPIU	2018-03-24 10:58:48 +01:00
i2c	i2c: i2c-scmi: add a MS HID	2018-03-24 10:58:41 +01:00
ide
idle	idle: i7300: add PCI dependency	2018-02-25 11:03:51 +01:00
iio	iio: st_pressure: st_accel: pass correct platform data to init	2018-03-28 18:40:12 +02:00
infiniband	RDMA/ucma: Check AF family prior resolving address	2018-04-08 11:51:58 +02:00
input	Input: mousedev - fix implicit conversion warning	2018-04-08 11:51:57 +02:00
iommu	iommu/vt-d: clean up pr_irq if request_threaded_irq fails	2018-03-24 10:58:48 +01:00
ipack
irqchip	irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis	2018-03-22 09:23:31 +01:00
isdn	isdn: sc: work around type mismatch warning	2018-02-25 11:03:51 +01:00
leds	Revert "led: core: Fix brightness setting when setting delay_off=0"	2018-03-11 16:19:45 +01:00
lguest
lightnvm
macintosh
mailbox	mailbox: handle empty message in tx_tick	2017-08-06 19:19:41 -07:00
mcb
md	dm ioctl: remove double parentheses	2018-04-08 11:51:57 +02:00
media	media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart	2018-03-24 10:58:47 +01:00
memory	ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure	2017-12-16 10:33:51 +01:00
memstick
message	mptfusion: hide unused seq_mpt_print_ioc_summary function	2018-02-25 11:03:45 +01:00
mfd	mfd: palmas: Reset the POWERHOLD mux during power off	2018-03-24 10:58:44 +01:00
misc	scsi: ses: don't get power status of SES device slot on probe	2018-03-22 09:23:24 +01:00
mmc	mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs	2018-03-28 18:40:13 +02:00
mtd	mtd: jedec_probe: Fix crash in jedec_read_mfr()	2018-04-08 11:51:55 +02:00
net	net: systemport: Rewrite __bcm_sysport_tx_reclaim()	2018-03-31 18:12:34 +02:00
nfc	NFC: nfcmrvl: double free on error path	2018-03-22 09:23:23 +01:00
ntb	ntb_transport: fix bug calculating num_qps_mw	2017-08-30 10:19:29 +02:00
nubus
nvdimm	libnvdimm, namespace: make 'resource' attribute only readable by root	2017-11-30 08:37:23 +00:00
nvme	nvme: Fix managing degraded controllers	2018-02-16 20:09:47 +01:00
nvmem	nvmem: imx-ocotp: Fix wrong register size	2017-08-06 19:19:46 -07:00
of	of: fix of_device_get_modalias returned length when truncating buffers	2018-03-22 09:23:21 +01:00
oprofile
parisc	parisc: Hide Diva-built-in serial aux and graphics card	2018-01-02 20:33:20 +01:00
parport	parisc, parport_gsc: Fixes for printk continuation lines	2017-06-17 06:39:37 +02:00
pci	PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant	2018-04-08 11:51:57 +02:00
pcmcia
perf	drivers/perf: arm_pmu: handle no platform_device	2018-03-22 09:23:26 +01:00
phy	phy: work around 'phys' references to usb-nop-xceiv devices	2018-01-23 19:50:16 +01:00
pinctrl	pinctrl: Really force states during suspend/resume	2018-03-24 10:58:48 +01:00
platform	platform/chrome: Use proper protocol transfer function	2018-03-24 10:58:47 +01:00
pnp
power	power: supply: pda_power: move from timer to delayed_work	2018-03-24 10:58:45 +01:00
powercap
pps
ps3
ptp	time: Change posix clocks ops interfaces to use timespec64	2018-03-24 10:58:40 +01:00
pwm	pwm: tegra: Increase precision in PWM rate calculation	2018-03-22 09:23:27 +01:00
rapidio
ras
regulator	regulator: anatop: set default voltage selector for pcie	2018-03-24 10:58:40 +01:00
remoteproc
reset
rpmsg
rtc	rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL	2018-03-24 10:58:46 +01:00
s390	s390/qeth: on channel error, reject further cmd requests	2018-03-31 18:12:34 +02:00
sbus
scsi	scsi: sg: don't return bogus Sg_requests	2018-03-31 18:12:32 +02:00
sfi
sh
sn
soc
spi	spi: dw: Disable clock after unregistering the host	2018-03-24 10:58:41 +01:00
spmi	spmi: Include OF based modalias in device uevent	2017-07-27 15:06:10 -07:00
ssb	ssb: mark ssb_bus_register as __maybe_unused	2018-02-25 11:03:44 +01:00
staging	staging: lustre: ptlrpc: kfree used instead of kvfree	2018-03-28 18:40:17 +02:00
target	tcm_fileio: Prevent information leak for short reads	2018-03-24 10:58:45 +01:00
tc
thermal	thermal: spear: use __maybe_unused for PM functions	2018-02-25 11:03:44 +01:00
thunderbolt
tty	tty: vt: fix up tabstops properly	2018-03-28 18:40:16 +02:00
uio
usb	usb: gadget: f_hid: fix: Prevent accessing released memory	2018-04-08 11:51:56 +02:00
uwb	uwb: ensure that endpoint is interrupt	2017-10-12 11:27:35 +02:00
vfio	vfio-pci: Handle error from pci_iomap	2017-08-06 19:19:46 -07:00
vhost	vhost_net: stop device during reset owner	2018-02-16 20:09:38 +01:00
video	vgacon: Set VGA struct resource types	2018-03-24 10:58:48 +01:00
virt
virtio	virtio_balloon: prevent uninitialized variable use	2018-02-25 11:03:42 +01:00
vlynq
vme
w1
watchdog	watchdog: hpwdt: fix unused variable warning	2018-03-18 11:17:50 +01:00
xen	xen/gntdev: Fix partial gntdev_mmap() cleanup	2018-03-03 10:19:45 +01:00
zorro
Kconfig
Makefile	usb: build drivers/usb/common/ when USB_SUPPORT is set	2018-02-25 11:03:38 +01:00