• Jack Wang's avatar
    RDMA/rtrs: Fix KASAN: stack-out-of-bounds bug · 7fbc3c37
    Jack Wang authored
    When KASAN is enabled, we notice warning below:
    [  483.436975] ==================================================================
    [  483.437234] BUG: KASAN: stack-out-of-bounds in _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
    [  483.437430] Read of size 4 at addr ffff88a195fd7d30 by task kworker/1:3/6954
    
    [  483.437731] CPU: 1 PID: 6954 Comm: kworker/1:3 Kdump: loaded Tainted: G           O      5.4.82-pserver #5.4.82-1+feature+linux+5.4.y+dbg+20201210.1532+987e7a6~deb10
    [  483.437976] Hardware name: Supermicro Super Server/X11DDW-L, BIOS 3.3 02/21/2020
    [  483.438168] Workqueue: rtrs_server_wq hb_work [rtrs_core]
    [  483.438323] Call Trace:
    [  483.438486]  dump_stack+0x96/0xe0
    [  483.438646]  ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
    [  483.438802]  print_address_description.constprop.6+0x1b/0x220
    [  483.438966]  ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
    [  483.439133]  ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
    [  483.439285]  __kasan_report.cold.9+0x1a/0x32
    [  483.439444]  ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
    [  483.439597]  kasan_report+0x10/0x20
    [  483.439752]  _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
    [  483.439910]  ? update_sd_lb_stats+0xfb1/0xfc0
    [  483.440073]  ? set_reg_wr+0x520/0x520 [mlx5_ib]
    [  483.440222]  ? update_group_capacity+0x340/0x340
    [  483.440377]  ? find_busiest_group+0x314/0x870
    [  483.440526]  ? update_sd_lb_stats+0xfc0/0xfc0
    [  483.440683]  ? __bitmap_and+0x6f/0x100
    [  483.440832]  ? __lock_acquire+0xa2/0x2150
    [  483.440979]  ? __lock_acquire+0xa2/0x2150
    [  483.441128]  ? __lock_acquire+0xa2/0x2150
    [  483.441279]  ? debug_lockdep_rcu_enabled+0x23/0x60
    [  483.441430]  ? lock_downgrade+0x390/0x390
    [  483.441582]  ? __lock_acquire+0xa2/0x2150
    [  483.441729]  ? __lock_acquire+0xa2/0x2150
    [  483.441876]  ? newidle_balance+0x425/0x8f0
    [  483.442024]  ? __lock_acquire+0xa2/0x2150
    [  483.442172]  ? debug_lockdep_rcu_enabled+0x23/0x60
    [  483.442330]  hb_work+0x15d/0x1d0 [rtrs_core]
    [  483.442479]  ? schedule_hb+0x50/0x50 [rtrs_core]
    [  483.442627]  ? lock_downgrade+0x390/0x390
    [  483.442781]  ? process_one_work+0x40d/0xa50
    [  483.442931]  process_one_work+0x4ee/0xa50
    [  483.443082]  ? pwq_dec_nr_in_flight+0x110/0x110
    [  483.443231]  ? do_raw_spin_lock+0x119/0x1d0
    [  483.443383]  worker_thread+0x65/0x5c0
    [  483.443532]  ? process_one_work+0xa50/0xa50
    [  483.451839]  kthread+0x1e2/0x200
    [  483.451983]  ? kthread_create_on_node+0xc0/0xc0
    [  483.452139]  ret_from_fork+0x3a/0x50
    
    The problem is we use wrong type when send wr, hw driver expect the type
    of IB_WR_RDMA_WRITE_WITH_IMM wr should be ib_rdma_wr, and doing
    container_of to access member. The fix is simple use ib_rdma_wr instread
    of ib_send_wr.
    
    Fixes: c0894b3e ("RDMA/rtrs: core: lib functions shared between client and server modules")
    Link: https://lore.kernel.org/r/20201217141915.56989-20-jinpu.wang@cloud.ionos.comSigned-off-by: default avatarJack Wang <jinpu.wang@cloud.ionos.com>
    Reviewed-by: default avatarGioh Kim <gi-oh.kim@cloud.ionos.com>
    Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
    7fbc3c37
rtrs.c 14 KB