patches/kernel/0011-IB-core-Avoid-crash-on-pkey-enforcement-failed-in-re.patch

   1 From: Parav Pandit <parav@mellanox.com>
   2 Subject: [PATCH] IB/core: Avoid crash on pkey enforcement failed in received MADs
   3
   4 commit 89548bcafec7ecfeea58c553f0834b5d575a66eb upstream.
   5
   6 Below kernel crash is observed when Pkey security enforcement fails on
   7 received MADs. This issue is reported in [1].
   8
   9 ib_free_recv_mad() accesses the rmpp_list, whose initialization is
  10 needed before accessing it.
  11 When security enformcent fails on received MADs, MAD processing avoided
  12 due to security checks failed.
  13
  14 OpenSM[3770]: SM port is down
  15 kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
  16 kernel: IP: ib_free_recv_mad+0x44/0xa0 [ib_core]
  17 kernel: PGD 0
  18 kernel: P4D 0
  19 kernel:
  20 kernel: Oops: 0002 [#1] SMP
  21 kernel: CPU: 0 PID: 2833 Comm: kworker/0:1H Tainted: P          IO    4.13.4-1-pve #1
  22 kernel: Hardware name: Dell       XS23-TY3        /9CMP63, BIOS 1.71 09/17/2013
  23 kernel: Workqueue: ib-comp-wq ib_cq_poll_work [ib_core]
  24 kernel: task: ffffa069c6541600 task.stack: ffffb9a729054000
  25 kernel: RIP: 0010:ib_free_recv_mad+0x44/0xa0 [ib_core]
  26 kernel: RSP: 0018:ffffb9a729057d38 EFLAGS: 00010286
  27 kernel: RAX: ffffa069cb138a48 RBX: ffffa069cb138a10 RCX: 0000000000000000
  28 kernel: RDX: ffffb9a729057d38 RSI: 0000000000000000 RDI: ffffa069cb138a20
  29 kernel: RBP: ffffb9a729057d60 R08: ffffa072d2d49800 R09: ffffa069cb138ae0
  30 kernel: R10: ffffa069cb138ae0 R11: ffffa072b3994e00 R12: ffffb9a729057d38
  31 kernel: R13: ffffa069d1c90000 R14: 0000000000000000 R15: ffffa069d1c90880
  32 kernel: FS:  0000000000000000(0000) GS:ffffa069dba00000(0000) knlGS:0000000000000000
  33 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  34 kernel: CR2: 0000000000000008 CR3: 00000011f51f2000 CR4: 00000000000006f0
  35 kernel: Call Trace:
  36 kernel:  ib_mad_recv_done+0x5cc/0xb50 [ib_core]
  37 kernel:  __ib_process_cq+0x5c/0xb0 [ib_core]
  38 kernel:  ib_cq_poll_work+0x20/0x60 [ib_core]
  39 kernel:  process_one_work+0x1e9/0x410
  40 kernel:  worker_thread+0x4b/0x410
  41 kernel:  kthread+0x109/0x140
  42 kernel:  ? process_one_work+0x410/0x410
  43 kernel:  ? kthread_create_on_node+0x70/0x70
  44 kernel:  ? SyS_exit_group+0x14/0x20
  45 kernel:  ret_from_fork+0x25/0x30
  46 kernel: RIP: ib_free_recv_mad+0x44/0xa0 [ib_core] RSP: ffffb9a729057d38
  47 kernel: CR2: 0000000000000008
  48
  49 [1] : https://www.spinics.net/lists/linux-rdma/msg56190.html
  50
  51 Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams")
  52 Signed-off-by: Parav Pandit <parav@mellanox.com>
  53 Reported-by: Chris Blake <chrisrblake93@gmail.com>
  54 Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
  55 Reviewed-by: Hal Rosenstock <hal@mellanox.com>
  56 Signed-off-by: Doug Ledford <dledford@redhat.com>
  57 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  58
  59 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  60 ---
  61  drivers/infiniband/core/mad.c | 3 ++-
  62  1 file changed, 2 insertions(+), 1 deletion(-)
  63
  64 diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
  65 index f8f53bb90837..cb91245e9163 100644
  66 --- a/drivers/infiniband/core/mad.c
  67 +++ b/drivers/infiniband/core/mad.c
  68 @@ -1974,14 +1974,15 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
  69         unsigned long flags;
  70         int ret;
  71
  72 +       INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
  73         ret = ib_mad_enforce_security(mad_agent_priv,
  74                                       mad_recv_wc->wc->pkey_index);
  75         if (ret) {
  76                 ib_free_recv_mad(mad_recv_wc);
  77                 deref_mad_agent(mad_agent_priv);
  78 +               return;
  79         }
  80
  81 -       INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
  82         list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
  83         if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
  84                 mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
  85 --
  86 2.14.2
  87