• Bart Van Assche's avatar
    RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access · a1ae7d03
    Bart Van Assche authored
    This patch fixes the following KASAN complaint:
    
    ==================================================================
    BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x77d/0x9b0 [rdma_rxe]
    Read of size 8 at addr ffff880061aef860 by task 01/1080
    
    CPU: 2 PID: 1080 Comm: 01 Not tainted 4.16.0-rc3-dbg+ #2
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
    Call Trace:
    dump_stack+0x85/0xc7
    print_address_description+0x65/0x270
    kasan_report+0x231/0x350
    rxe_post_send+0x77d/0x9b0 [rdma_rxe]
    __ib_drain_sq+0x1ad/0x250 [ib_core]
    ib_drain_qp+0x9/0x30 [ib_core]
    srp_destroy_qp+0x51/0x70 [ib_srp]
    srp_free_ch_ib+0xfc/0x380 [ib_srp]
    srp_create_target+0x1071/0x19e0 [ib_srp]
    kernfs_fop_write+0x180/0x210
    __vfs_write+0xb1/0x2e0
    vfs_write+0xf6/0x250
    SyS_write+0x99/0x110
    do_syscall_64+0xee/0x2b0
    entry_SYSCALL_64_after_hwframe+0x42/0xb7
    
    The buggy address belongs to the page:
    page:ffffea000186bbc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
    flags: 0x4000000000000000()
    raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
    raw: 0000000000000000 ffffea000186bbe0 0000000000000000 0000000000000000
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
    ffff880061aef700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    ffff880061aef780: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
    >ffff880061aef800: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2
                                                          ^
    ffff880061aef880: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 f2 f2
    ffff880061aef900: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00
    ==================================================================
    
    Fixes: 765d6774 ("IB: new common API for draining queues")
    Signed-off-by: default avatarBart Van Assche <bart.vanassche@wdc.com>
    Cc: Steve Wise <swise@opengridcomputing.com>
    Cc: Sagi Grimberg <sagi@grimberg.me>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    a1ae7d03
verbs.c 60.5 KB