mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-02-11 07:05:12 +07:00
![Leon Romanovsky](/assets/img/avatar_default.png)
The RDMA netlink core code checks validity of messages by ensuring
that type and operand are in range. It works well for almost all
clients except NLDEV, which has cb_table less than number of operands.
Request to access such operand will trigger the following kernel panic.
This patch updates all places where cb_table is declared for the
consistency, but only NLDEV is actually need it.
general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 0 PID: 522 Comm: syz-executor6 Not tainted 4.13.0+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
task: ffff8800657799c0 task.stack: ffff8800695d000
RIP: 0010:rdma_nl_rcv_msg+0x13a/0x4c0
RSP: 0018:ffff8800695d7838 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: 1ffff1000d2baf0b RCX: 00000000704ff4d7
RDX: 0000000000000000 RSI: ffffffff81ddb03c RDI: 00000003827fa6bc
RBP: ffff8800695d7900 R08: ffffffff82ec0578 R09: 0000000000000000
R10: ffff8800695d7900 R11: 0000000000000001 R12: 000000000000001c
R13: ffff880069d31e00 R14: 00000000ffffffff R15: ffff880069d357c0
FS: 00007fee6acb8700(0000) GS:ffff88006ca00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000201a9000 CR3: 0000000059766000 CR4: 00000000000006b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
? rdma_nl_multicast+0x80/0x80
rdma_nl_rcv+0x36b/0x4d0
? ibnl_put_attr+0xc0/0xc0
netlink_unicast+0x4bd/0x6d0
? netlink_sendskb+0x50/0x50
? drop_futex_key_refs.isra.4+0x68/0xb0
netlink_sendmsg+0x9ab/0xbd0
? nlmsg_notify+0x140/0x140
? wake_up_q+0xa1/0xf0
? drop_futex_key_refs.isra.4+0x68/0xb0
sock_sendmsg+0x88/0xd0
sock_write_iter+0x228/0x3c0
? sock_sendmsg+0xd0/0xd0
? do_futex+0x3e5/0xb20
? iov_iter_init+0xaf/0x1d0
__vfs_write+0x46e/0x640
? sched_clock_cpu+0x1b/0x190
? __vfs_read+0x620/0x620
? __fget+0x23a/0x390
? rw_verify_area+0xca/0x290
vfs_write+0x192/0x490
SyS_write+0xde/0x1c0
? SyS_read+0x1c0/0x1c0
? trace_hardirqs_on_thunk+0x1a/0x1c
entry_SYSCALL_64_fastpath+0x18/0xad
RIP: 0033:0x7fee6a74a219
RSP: 002b:00007fee6acb7d58 EFLAGS: 00000212 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000638000 RCX: 00007fee6a74a219
RDX: 0000000000000078 RSI: 0000000020141000 RDI: 0000000000000006
RBP: 0000000000000046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: ffff8800695d7f98
R13: 0000000020141000 R14: 0000000000000006 R15: 00000000ffffffff
Code: d6 48 b8 00 00 00 00 00 fc ff df 66 41 81 e4 ff 03 44 8d 72 ff 4a 8d 3c b5 c0 a6 7f 82 44 89 b5 4c ff ff ff 48 89 f9 48 c1 e9 03 <0f> b6 0c 01 48 89 f8 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85
RIP: rdma_nl_rcv_msg+0x13a/0x4c0 RSP: ffff8800695d7838
---[ end trace ba085d123959c8ec ]---
Kernel panic - not syncing: Fatal exception
Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: b4c598a67e
("RDMA/netlink: Implement nldev device dumpit calback")
Reviewed-by: Mark Bloch <markb@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
328 lines
9.3 KiB
C
328 lines
9.3 KiB
C
/*
|
|
* Copyright (c) 2017 Mellanox Technologies. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the names of the copyright holders nor the names of its
|
|
* contributors may be used to endorse or promote products derived from
|
|
* this software without specific prior written permission.
|
|
*
|
|
* Alternatively, this software may be distributed under the terms of the
|
|
* GNU General Public License ("GPL") version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
|
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <net/netlink.h>
|
|
#include <rdma/rdma_netlink.h>
|
|
|
|
#include "core_priv.h"
|
|
|
|
static const struct nla_policy nldev_policy[RDMA_NLDEV_ATTR_MAX] = {
|
|
[RDMA_NLDEV_ATTR_DEV_INDEX] = { .type = NLA_U32 },
|
|
[RDMA_NLDEV_ATTR_DEV_NAME] = { .type = NLA_NUL_STRING,
|
|
.len = IB_DEVICE_NAME_MAX - 1},
|
|
[RDMA_NLDEV_ATTR_PORT_INDEX] = { .type = NLA_U32 },
|
|
[RDMA_NLDEV_ATTR_FW_VERSION] = { .type = NLA_NUL_STRING,
|
|
.len = IB_FW_VERSION_NAME_MAX - 1},
|
|
[RDMA_NLDEV_ATTR_NODE_GUID] = { .type = NLA_U64 },
|
|
[RDMA_NLDEV_ATTR_SYS_IMAGE_GUID] = { .type = NLA_U64 },
|
|
[RDMA_NLDEV_ATTR_SUBNET_PREFIX] = { .type = NLA_U64 },
|
|
[RDMA_NLDEV_ATTR_LID] = { .type = NLA_U32 },
|
|
[RDMA_NLDEV_ATTR_SM_LID] = { .type = NLA_U32 },
|
|
[RDMA_NLDEV_ATTR_LMC] = { .type = NLA_U8 },
|
|
[RDMA_NLDEV_ATTR_PORT_STATE] = { .type = NLA_U8 },
|
|
[RDMA_NLDEV_ATTR_PORT_PHYS_STATE] = { .type = NLA_U8 },
|
|
[RDMA_NLDEV_ATTR_DEV_NODE_TYPE] = { .type = NLA_U8 },
|
|
};
|
|
|
|
static int fill_dev_info(struct sk_buff *msg, struct ib_device *device)
|
|
{
|
|
char fw[IB_FW_VERSION_NAME_MAX];
|
|
|
|
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_DEV_INDEX, device->index))
|
|
return -EMSGSIZE;
|
|
if (nla_put_string(msg, RDMA_NLDEV_ATTR_DEV_NAME, device->name))
|
|
return -EMSGSIZE;
|
|
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_PORT_INDEX, rdma_end_port(device)))
|
|
return -EMSGSIZE;
|
|
|
|
BUILD_BUG_ON(sizeof(device->attrs.device_cap_flags) != sizeof(u64));
|
|
if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_CAP_FLAGS,
|
|
device->attrs.device_cap_flags, 0))
|
|
return -EMSGSIZE;
|
|
|
|
ib_get_device_fw_str(device, fw);
|
|
/* Device without FW has strlen(fw) */
|
|
if (strlen(fw) && nla_put_string(msg, RDMA_NLDEV_ATTR_FW_VERSION, fw))
|
|
return -EMSGSIZE;
|
|
|
|
if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_NODE_GUID,
|
|
be64_to_cpu(device->node_guid), 0))
|
|
return -EMSGSIZE;
|
|
if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_SYS_IMAGE_GUID,
|
|
be64_to_cpu(device->attrs.sys_image_guid), 0))
|
|
return -EMSGSIZE;
|
|
if (nla_put_u8(msg, RDMA_NLDEV_ATTR_DEV_NODE_TYPE, device->node_type))
|
|
return -EMSGSIZE;
|
|
return 0;
|
|
}
|
|
|
|
static int fill_port_info(struct sk_buff *msg,
|
|
struct ib_device *device, u32 port)
|
|
{
|
|
struct ib_port_attr attr;
|
|
int ret;
|
|
|
|
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_DEV_INDEX, device->index))
|
|
return -EMSGSIZE;
|
|
if (nla_put_string(msg, RDMA_NLDEV_ATTR_DEV_NAME, device->name))
|
|
return -EMSGSIZE;
|
|
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_PORT_INDEX, port))
|
|
return -EMSGSIZE;
|
|
|
|
ret = ib_query_port(device, port, &attr);
|
|
if (ret)
|
|
return ret;
|
|
|
|
BUILD_BUG_ON(sizeof(attr.port_cap_flags) > sizeof(u64));
|
|
if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_CAP_FLAGS,
|
|
(u64)attr.port_cap_flags, 0))
|
|
return -EMSGSIZE;
|
|
if (rdma_protocol_ib(device, port) &&
|
|
nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_SUBNET_PREFIX,
|
|
attr.subnet_prefix, 0))
|
|
return -EMSGSIZE;
|
|
if (rdma_protocol_ib(device, port)) {
|
|
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_LID, attr.lid))
|
|
return -EMSGSIZE;
|
|
if (nla_put_u32(msg, RDMA_NLDEV_ATTR_SM_LID, attr.sm_lid))
|
|
return -EMSGSIZE;
|
|
if (nla_put_u8(msg, RDMA_NLDEV_ATTR_LMC, attr.lmc))
|
|
return -EMSGSIZE;
|
|
}
|
|
if (nla_put_u8(msg, RDMA_NLDEV_ATTR_PORT_STATE, attr.state))
|
|
return -EMSGSIZE;
|
|
if (nla_put_u8(msg, RDMA_NLDEV_ATTR_PORT_PHYS_STATE, attr.phys_state))
|
|
return -EMSGSIZE;
|
|
return 0;
|
|
}
|
|
|
|
static int nldev_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct nlattr *tb[RDMA_NLDEV_ATTR_MAX];
|
|
struct ib_device *device;
|
|
struct sk_buff *msg;
|
|
u32 index;
|
|
int err;
|
|
|
|
err = nlmsg_parse(nlh, 0, tb, RDMA_NLDEV_ATTR_MAX - 1,
|
|
nldev_policy, extack);
|
|
if (err || !tb[RDMA_NLDEV_ATTR_DEV_INDEX])
|
|
return -EINVAL;
|
|
|
|
index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
|
|
|
|
device = __ib_device_get_by_index(index);
|
|
if (!device)
|
|
return -EINVAL;
|
|
|
|
msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
|
|
if (!msg)
|
|
return -ENOMEM;
|
|
|
|
nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
|
|
RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET),
|
|
0, 0);
|
|
|
|
err = fill_dev_info(msg, device);
|
|
if (err) {
|
|
nlmsg_free(msg);
|
|
return err;
|
|
}
|
|
|
|
nlmsg_end(msg, nlh);
|
|
|
|
return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
|
|
}
|
|
|
|
static int _nldev_get_dumpit(struct ib_device *device,
|
|
struct sk_buff *skb,
|
|
struct netlink_callback *cb,
|
|
unsigned int idx)
|
|
{
|
|
int start = cb->args[0];
|
|
struct nlmsghdr *nlh;
|
|
|
|
if (idx < start)
|
|
return 0;
|
|
|
|
nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
|
|
RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET),
|
|
0, NLM_F_MULTI);
|
|
|
|
if (fill_dev_info(skb, device)) {
|
|
nlmsg_cancel(skb, nlh);
|
|
goto out;
|
|
}
|
|
|
|
nlmsg_end(skb, nlh);
|
|
|
|
idx++;
|
|
|
|
out: cb->args[0] = idx;
|
|
return skb->len;
|
|
}
|
|
|
|
static int nldev_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
|
|
{
|
|
/*
|
|
* There is no need to take lock, because
|
|
* we are relying on ib_core's lists_rwsem
|
|
*/
|
|
return ib_enum_all_devs(_nldev_get_dumpit, skb, cb);
|
|
}
|
|
|
|
static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct nlattr *tb[RDMA_NLDEV_ATTR_MAX];
|
|
struct ib_device *device;
|
|
struct sk_buff *msg;
|
|
u32 index;
|
|
u32 port;
|
|
int err;
|
|
|
|
err = nlmsg_parse(nlh, 0, tb, RDMA_NLDEV_ATTR_MAX - 1,
|
|
nldev_policy, extack);
|
|
if (err ||
|
|
!tb[RDMA_NLDEV_ATTR_DEV_INDEX] ||
|
|
!tb[RDMA_NLDEV_ATTR_PORT_INDEX])
|
|
return -EINVAL;
|
|
|
|
index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
|
|
device = __ib_device_get_by_index(index);
|
|
if (!device)
|
|
return -EINVAL;
|
|
|
|
port = nla_get_u32(tb[RDMA_NLDEV_ATTR_PORT_INDEX]);
|
|
if (!rdma_is_port_valid(device, port))
|
|
return -EINVAL;
|
|
|
|
msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
|
|
if (!msg)
|
|
return -ENOMEM;
|
|
|
|
nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
|
|
RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET),
|
|
0, 0);
|
|
|
|
err = fill_port_info(msg, device, port);
|
|
if (err) {
|
|
nlmsg_free(msg);
|
|
return err;
|
|
}
|
|
|
|
nlmsg_end(msg, nlh);
|
|
|
|
return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
|
|
}
|
|
|
|
static int nldev_port_get_dumpit(struct sk_buff *skb,
|
|
struct netlink_callback *cb)
|
|
{
|
|
struct nlattr *tb[RDMA_NLDEV_ATTR_MAX];
|
|
struct ib_device *device;
|
|
int start = cb->args[0];
|
|
struct nlmsghdr *nlh;
|
|
u32 idx = 0;
|
|
u32 ifindex;
|
|
int err;
|
|
u32 p;
|
|
|
|
err = nlmsg_parse(cb->nlh, 0, tb, RDMA_NLDEV_ATTR_MAX - 1,
|
|
nldev_policy, NULL);
|
|
if (err || !tb[RDMA_NLDEV_ATTR_DEV_INDEX])
|
|
return -EINVAL;
|
|
|
|
ifindex = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
|
|
device = __ib_device_get_by_index(ifindex);
|
|
if (!device)
|
|
return -EINVAL;
|
|
|
|
for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
|
|
/*
|
|
* The dumpit function returns all information from specific
|
|
* index. This specific index is taken from the netlink
|
|
* messages request sent by user and it is available
|
|
* in cb->args[0].
|
|
*
|
|
* Usually, the user doesn't fill this field and it causes
|
|
* to return everything.
|
|
*
|
|
*/
|
|
if (idx < start) {
|
|
idx++;
|
|
continue;
|
|
}
|
|
|
|
nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid,
|
|
cb->nlh->nlmsg_seq,
|
|
RDMA_NL_GET_TYPE(RDMA_NL_NLDEV,
|
|
RDMA_NLDEV_CMD_PORT_GET),
|
|
0, NLM_F_MULTI);
|
|
|
|
if (fill_port_info(skb, device, p)) {
|
|
nlmsg_cancel(skb, nlh);
|
|
goto out;
|
|
}
|
|
idx++;
|
|
nlmsg_end(skb, nlh);
|
|
}
|
|
|
|
out: cb->args[0] = idx;
|
|
return skb->len;
|
|
}
|
|
|
|
static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
|
|
[RDMA_NLDEV_CMD_GET] = {
|
|
.doit = nldev_get_doit,
|
|
.dump = nldev_get_dumpit,
|
|
},
|
|
[RDMA_NLDEV_CMD_PORT_GET] = {
|
|
.doit = nldev_port_get_doit,
|
|
.dump = nldev_port_get_dumpit,
|
|
},
|
|
};
|
|
|
|
void __init nldev_init(void)
|
|
{
|
|
rdma_nl_register(RDMA_NL_NLDEV, nldev_cb_table);
|
|
}
|
|
|
|
void __exit nldev_exit(void)
|
|
{
|
|
rdma_nl_unregister(RDMA_NL_NLDEV);
|
|
}
|
|
|
|
MODULE_ALIAS_RDMA_NETLINK(RDMA_NL_NLDEV, 5);
|