lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 091/265] IB/mad: Fix use after free when destroying MAD agent
    Date
    From: Shay Drory <shayd@mellanox.com>

    commit 116a1b9f1cb769b83e5adff323f977a62b1dcb2e upstream.

    Currently, when RMPP MADs are processed while the MAD agent is destroyed,
    it could result in use after free of rmpp_recv, as decribed below:

    cpu-0 cpu-1
    ----- -----
    ib_mad_recv_done()
    ib_mad_complete_recv()
    ib_process_rmpp_recv_wc()
    unregister_mad_agent()
    ib_cancel_rmpp_recvs()
    cancel_delayed_work()
    process_rmpp_data()
    start_rmpp()
    queue_delayed_work(rmpp_recv->cleanup_work)
    destroy_rmpp_recv()
    free_rmpp_recv()
    cleanup_work()[1]
    spin_lock_irqsave(&rmpp_recv->agent->lock) <-- use after free

    [1] cleanup_work() == recv_cleanup_handler

    Fix it by waiting for the MAD agent reference count becoming zero before
    calling to ib_cancel_rmpp_recvs().

    Fixes: 9a41e38a467c ("IB/mad: Use IDR for agent IDs")
    Link: https://lore.kernel.org/r/20200621104738.54850-2-leon@kernel.org
    Signed-off-by: Shay Drory <shayd@mellanox.com>
    Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
    Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/infiniband/core/mad.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
    index c54db13fa9b0a..f7626ebcf31cf 100644
    --- a/drivers/infiniband/core/mad.c
    +++ b/drivers/infiniband/core/mad.c
    @@ -639,10 +639,10 @@ static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
    xa_erase(&ib_mad_clients, mad_agent_priv->agent.hi_tid);

    flush_workqueue(port_priv->wq);
    - ib_cancel_rmpp_recvs(mad_agent_priv);

    deref_mad_agent(mad_agent_priv);
    wait_for_completion(&mad_agent_priv->comp);
    + ib_cancel_rmpp_recvs(mad_agent_priv);

    ib_mad_agent_security_cleanup(&mad_agent_priv->agent);

    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-30 00:10    [W:3.481 / U:0.420 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site