• Bart Van Assche's avatar
    RDMA/rxe: Fix an out-of-bounds read · a6544a62
    Bart Van Assche authored
    This patch avoids that KASAN reports the following when the SRP initiator
    calls srp_post_send():
    
    ==================================================================
    BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x5c4/0x980 [rdma_rxe]
    Read of size 8 at addr ffff880066606e30 by task 02-mq/1074
    
    CPU: 2 PID: 1074 Comm: 02-mq Not tainted 4.16.0-rc3-dbg+ #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
    Call Trace:
    dump_stack+0x85/0xc7
    print_address_description+0x65/0x270
    kasan_report+0x231/0x350
    rxe_post_send+0x5c4/0x980 [rdma_rxe]
    srp_post_send.isra.16+0x149/0x190 [ib_srp]
    srp_queuecommand+0x94d/0x1670 [ib_srp]
    scsi_dispatch_cmd+0x1c2/0x550 [scsi_mod]
    scsi_queue_rq+0x843/0xa70 [scsi_mod]
    blk_mq_dispatch_rq_list+0x143/0xac0
    blk_mq_do_dispatch_ctx+0x1c5/0x260
    blk_mq_sched_dispatch_requests+0x2bf/0x2f0
    __blk_mq_run_hw_queue+0xdb/0x160
    __blk_mq_delay_run_hw_queue+0xba/0x100
    blk_mq_run_hw_queue+0xf2/0x190
    blk_mq_sched_insert_request+0x163/0x2f0
    blk_execute_rq+0xb0/0x130
    scsi_execute+0x14e/0x260 [scsi_mod]
    scsi_probe_and_add_lun+0x366/0x13d0 [scsi_mod]
    __scsi_scan_target+0x18a/0x810 [scsi_mod]
    scsi_scan_target+0x11e/0x130 [scsi_mod]
    srp_create_target+0x1522/0x19e0 [ib_srp]
    kernfs_fop_write+0x180/0x210
    __vfs_write+0xb1/0x2e0
    vfs_write+0xf6/0x250
    SyS_write+0x99/0x110
    do_syscall_64+0xee/0x2b0
    entry_SYSCALL_64_after_hwframe+0x42/0xb7
    
    The buggy address belongs to the page:
    page:ffffea0001998180 count:0 mapcount:0 mapping:0000000000000000 index:0x0
    flags: 0x4000000000000000()
    raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
    raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
    ffff880066606d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
    ffff880066606d80: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 f2 f2 f2 f2 f2
    >ffff880066606e00: f2 00 00 00 00 00 f2 f2 f2 f3 f3 f3 f3 00 00 00
                                        ^
    ffff880066606e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    ffff880066606f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    ==================================================================
    
    Fixes: 8700e3e7 ("Soft RoCE driver")
    Signed-off-by: default avatarBart Van Assche <bart.vanassche@wdc.com>
    Cc: Moni Shoua <monis@mellanox.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    a6544a62
rxe_verbs.c 28.6 KB