| Message ID | 20240920124540.2392571-1-haixiao.yan.cn@windriver.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | RDMA/hns: Fix UAF for cq async event | expand |
On Fri, Sep 20, 2024 at 08:45:40PM +0800, haixiao.yan.cn@windriver.com wrote: > From: Chengchang Tang <tangchengchang@huawei.com> > > [ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ] > > The refcount of CQ is not protected by locks. When CQ asynchronous > events and CQ destruction are concurrent, CQ may have been released, > which will cause UAF. > > Use the xa_lock() to protect the CQ refcount. > > Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") > Signed-off-by: Chengchang Tang <tangchengchang@huawei.com> > Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> > Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com > Signed-off-by: Leon Romanovsky <leon@kernel.org> > Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> > --- > This commit is backporting a942ec2745ca to the branch linux-5.15.y to > solve the CVE-2024-38545. Please merge this commit to linux-5.15.y. Don't you need to send this to the stable maintainers too? Jason
Add Greg in the loop. Thanks. On 9/20/2024 8:57 PM, Jason Gunthorpe wrote: > CAUTION: This email comes from a non Wind River email account! > Do not click links or open attachments unless you recognize the sender and know the content is safe. > > On Fri, Sep 20, 2024 at 08:45:40PM +0800, haixiao.yan.cn@windriver.com wrote: >> From: Chengchang Tang <tangchengchang@huawei.com> >> >> [ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ] >> >> The refcount of CQ is not protected by locks. When CQ asynchronous >> events and CQ destruction are concurrent, CQ may have been released, >> which will cause UAF. >> >> Use the xa_lock() to protect the CQ refcount. >> >> Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") >> Signed-off-by: Chengchang Tang <tangchengchang@huawei.com> >> Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> >> Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com >> Signed-off-by: Leon Romanovsky <leon@kernel.org> >> Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> >> --- >> This commit is backporting a942ec2745ca to the branch linux-5.15.y to >> solve the CVE-2024-38545. Please merge this commit to linux-5.15.y. > Don't you need to send this to the stable maintainers too? > > Jason
On Fri, Sep 20, 2024 at 09:02:58PM +0800, Yan, Haixiao (CN) wrote:
> Add Greg in the loop. Thanks.
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>
diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c index d763f097599f..5ecd4075de93 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cq.c +++ b/drivers/infiniband/hw/hns/hns_roce_cq.c @@ -125,7 +125,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) goto err_out; } - ret = xa_err(xa_store(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL)); + ret = xa_err(xa_store_irq(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL)); if (ret) { ibdev_err(ibdev, "failed to xa_store CQ, ret = %d.\n", ret); goto err_put; @@ -160,8 +160,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) return 0; err_xa: - xa_erase(&cq_table->array, hr_cq->cqn); - + xa_erase_irq(&cq_table->array, hr_cq->cqn); err_put: hns_roce_table_put(hr_dev, &cq_table->table, hr_cq->cqn); @@ -182,7 +181,7 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) dev_err(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", ret, hr_cq->cqn); - xa_erase(&cq_table->array, hr_cq->cqn); + xa_erase_irq(&cq_table->array, hr_cq->cqn); /* Waiting interrupt process procedure carried out */ synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq); @@ -478,13 +477,6 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) struct ib_event event; struct ib_cq *ibcq; - hr_cq = xa_load(&hr_dev->cq_table.array, - cqn & (hr_dev->caps.num_cqs - 1)); - if (!hr_cq) { - dev_warn(dev, "Async event for bogus CQ 0x%06x\n", cqn); - return; - } - if (event_type != HNS_ROCE_EVENT_TYPE_CQ_ID_INVALID && event_type != HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR && event_type != HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW) { @@ -493,7 +485,16 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) return; } - refcount_inc(&hr_cq->refcount); + xa_lock(&hr_dev->cq_table.array); + hr_cq = xa_load(&hr_dev->cq_table.array, + cqn & (hr_dev->caps.num_cqs - 1)); + if (hr_cq) + refcount_inc(&hr_cq->refcount); + xa_unlock(&hr_dev->cq_table.array); + if (!hr_cq) { + dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn); + return; + } ibcq = &hr_cq->ib_cq; if (ibcq->event_handler) {