From patchwork Mon Dec 17 21:20:40 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10734315 X-Patchwork-Delegate: dledford@redhat.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BE1281399 for ; Mon, 17 Dec 2018 21:21:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B04552A1C4 for ; Mon, 17 Dec 2018 21:21:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A47EA2A1D4; Mon, 17 Dec 2018 21:21:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 38AF42A1C4 for ; Mon, 17 Dec 2018 21:21:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732467AbeLQVVY (ORCPT ); Mon, 17 Dec 2018 16:21:24 -0500 Received: from com-out001.mailprotect.be ([83.217.72.83]:38039 "EHLO com-out001.mailprotect.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732195AbeLQVVY (ORCPT ); Mon, 17 Dec 2018 16:21:24 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mailprotect.be; s=mail; h=Content-Transfer-Encoding:MIME-Version:References :In-Reply-To:Message-Id:Date:Subject:Cc:To:From:reply-to:sender:bcc: content-type; bh=9dQpA0MrqO3Owmc5c7xt7DGV7VpV07X5c8NbNdruhB4=; b=GwHPoIyax/n9 EWj5eUzkCUgX/pmSyLaQzA1Xs56pRcQAtZg0SPxGtl2QdctSYqA5UrzrRLcxvmQ+P3fRl0ugwpLga xlfuNkY4LmC0Epioy6ol3z5yY2CRZE5nBl7Vgy03iay43XVQK4hzjhBxOgsl1yb0ed1ZEdfp+mjZp lrFQRG81sWptpuL9c+/NNVF6N998CTRKn6invlFRi3sI2evO7rVs9DUc3DWtL98QZN+C9Z0rnOSg0 ISQoI1HLngaKT9svQKKF3tUE0y1hV60qlYohLDNw3kx8gjyQq/fqK4hgWm6vqum/GGxRrCIgS4yOP omELNFO4yRMjbXab5xHsVQ==; Received: from smtp-auth.mailprotect.be ([178.208.39.159]) by com-mpt-out001.mailprotect.be with esmtp (Exim 4.89) (envelope-from ) id 1gZ0KF-0001Zd-DI; Mon, 17 Dec 2018 22:21:19 +0100 Received: from desktop-bart.svl.corp.google.com (unknown [104.133.8.89]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp-auth.mailprotect.be (Postfix) with ESMTPSA id 581E9C065E; Mon, 17 Dec 2018 22:21:17 +0100 (CET) From: Bart Van Assche To: Jason Gunthorpe Cc: Doug Ledford , linux-rdma@vger.kernel.org, Bart Van Assche , Sergey Gorenko , Max Gurtovoy , Laurence Oberman , stable@vger.kernel.org Subject: [PATCH v2 09/15] RDMA/srpt: Fix a use-after-free in the channel release code Date: Mon, 17 Dec 2018 13:20:40 -0800 Message-Id: <20181217212046.71017-10-bvanassche@acm.org> X-Mailer: git-send-email 2.20.0.405.gbc1bbc6f85-goog In-Reply-To: <20181217212046.71017-1-bvanassche@acm.org> References: <20181217212046.71017-1-bvanassche@acm.org> MIME-Version: 1.0 X-Originating-IP: 178.208.39.159 X-SpamExperts-Domain: mailprotect.be X-SpamExperts-Username: 178.208.39.128/27 Authentication-Results: mailprotect.be; auth=pass smtp.auth=178.208.39.128/27@mailprotect.be X-SpamExperts-Outgoing-Class: ham X-SpamExperts-Outgoing-Evidence: Combined (0.02) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5j+semjZcIen74JesYscvUp602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO1tLifGj39bI0bcPyaJsYTbLl/LY5YF9Vo2OhJGJjKCGCCZpQ81ZPiyihk8FOHdtvo4l V1QHumGYL6MoCWQBeDaU32qUPOJX7vhbzYcc5l71m4VKGlZauPS2ZI2/MGgfC8Av92G8VFvri8dZ 651y1LnBHvoYB1tNyzlE795H++xpIGTTJ1+gdXdk1Q+yT5nnagoNQ5DNiL8QB+UJGT4JjCrpphyP UPt9zJpS4kKwchXeopkI3zP1E6WYjFDj3Po4VtbjuU58k6ddZEUemp+2z73ypFxBJroUrrLy0IG/ gLu8TWUth/bIg1D/4cblfXFvIrwhcbIgt0qoJA65s+aV0TP5Yeia8HRRN1XgVEyTWHpXr3OnWExh FqqXKjnbUDBzcE+0HNyHhfqG0xcyQsZuCSP9hsa4s5F3MydIviotZvNHMvzpHD6s+1ao4iJ4PfBj 2N8Vdv96d+08iDufvobw6VUavl4snG+PRn+T8pp7vQV3rpLvOUh2w8gsgLX0uFSNx2AewJvG2VR5 mIGCzCE3N/asZm+FB8yckvFZiHWxnQEMkunODYtbvP72vAmOyjpz9UIDBHPtf27+c3J1HwicUV+G pS+C6BPAIEs8PiiVo3Eb3c7KClSBOi3EV0NWbVJ1KXxqWKxJiDvSXvZvXfo2UEYR9G8HIfDm0MPW TzQicTC9GplHcpVCCoX989hgB8R+yC9G9b3yazdC1eGXzxVaKphdoW8ELRMdd5tZtqdRHw0GAr6+ ulJqmSWp3e5Y0gAA2pTIqsriZLvaiGZnz91zoAMokdMyijyrNPLF2pjbdb3MosfYiA+A0wZZjhdL 0PpC7BEVniihuDwEGDcmr6e3OPQT0DVFoMDBp5PRUiQzcTDLKXYp8mSktA5RGpHjopTdf+IX1MwY aA3aQ0TOt0nOTZhV59YHFeKf6b5K9O638+ZHctgzcDoFd+96Xw4QUNtTnccFhhwn2/Dj1pgXRdkG FXml68sVQdV8jHytZ27+31Y2za3muS2OYzrgPLHf0Rbu9udKEy7bP5gIt23U7fpAnNPRUBWWBSDR x5OeloKLHRs0g0z5EfZrz6E5xburfSl74HBEn95eECKi3gxjzXac2CIo7bSWHMwv14kxH53zEku4 6CxjyQf09M5rialBcVt4x9u3hHG5f/LZAZC2bUhjWf0= X-Report-Abuse-To: spam@com-mpt-mgt001.mailprotect.be Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch avoids that KASAN sporadically reports the following: BUG: KASAN: use-after-free in rxe_run_task+0x1e/0x60 [rdma_rxe] Read of size 1 at addr ffff88801c50d8f4 by task check/24830 CPU: 4 PID: 24830 Comm: check Not tainted 4.20.0-rc6-dbg+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0x86/0xca print_address_description+0x71/0x239 kasan_report.cold.5+0x242/0x301 __asan_load1+0x47/0x50 rxe_run_task+0x1e/0x60 [rdma_rxe] rxe_post_send+0x4bd/0x8d0 [rdma_rxe] srpt_zerolength_write+0xe1/0x160 [ib_srpt] srpt_close_ch+0x8b/0xe0 [ib_srpt] srpt_set_enabled+0xe7/0x150 [ib_srpt] srpt_tpg_enable_store+0xc0/0x100 [ib_srpt] configfs_write_file+0x157/0x1d0 __vfs_write+0xd7/0x3d0 vfs_write+0x102/0x290 ksys_write+0xab/0x130 __x64_sys_write+0x43/0x50 do_syscall_64+0x71/0x210 entry_SYSCALL_64_after_hwframe+0x49/0xbe Allocated by task 13856: save_stack+0x43/0xd0 kasan_kmalloc+0xc7/0xe0 kasan_slab_alloc+0x11/0x20 kmem_cache_alloc+0x105/0x320 rxe_alloc+0xff/0x1f0 [rdma_rxe] rxe_create_qp+0x9f/0x160 [rdma_rxe] ib_create_qp+0xf5/0x690 [ib_core] rdma_create_qp+0x6a/0x140 [rdma_cm] srpt_cm_req_recv.cold.59+0x1588/0x237b [ib_srpt] srpt_rdma_cm_req_recv.isra.35+0x1d5/0x220 [ib_srpt] srpt_rdma_cm_handler+0x6f/0x100 [ib_srpt] cma_listen_handler+0x59/0x60 [rdma_cm] cma_ib_req_handler+0xd5b/0x2570 [rdma_cm] cm_process_work+0x2e/0x110 [ib_cm] cm_work_handler+0x2aae/0x502b [ib_cm] process_one_work+0x481/0x9e0 worker_thread+0x67/0x5b0 kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30 Freed by task 3440: save_stack+0x43/0xd0 __kasan_slab_free+0x139/0x190 kasan_slab_free+0xe/0x10 kmem_cache_free+0xbc/0x330 rxe_elem_release+0x66/0xe0 [rdma_rxe] rxe_destroy_qp+0x3f/0x50 [rdma_rxe] ib_destroy_qp+0x140/0x360 [ib_core] srpt_release_channel_work+0xdc/0x310 [ib_srpt] process_one_work+0x481/0x9e0 worker_thread+0x67/0x5b0 kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30 Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Cc: Signed-off-by: Bart Van Assche --- drivers/infiniband/ulp/srpt/ib_srpt.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index adc0e91d2bb5..02d9b758e58f 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -2010,6 +2010,14 @@ static void srpt_free_ch(struct kref *kref) kfree_rcu(ch, rcu); } +/* + * Shut down the SCSI target session, tell the connection manager to + * disconnect the associated RDMA channel, transition the QP to the error + * state and remove the channel from the channel list. This function is + * typically called from inside srpt_zerolength_write_done(). Concurrent + * srpt_zerolength_write() calls from inside srpt_close_ch() are possible + * as long as the channel is on sport->nexus_list. + */ static void srpt_release_channel_work(struct work_struct *w) { struct srpt_rdma_ch *ch; @@ -2037,6 +2045,11 @@ static void srpt_release_channel_work(struct work_struct *w) else ib_destroy_cm_id(ch->ib_cm.cm_id); + sport = ch->sport; + mutex_lock(&sport->mutex); + list_del_rcu(&ch->list); + mutex_unlock(&sport->mutex); + srpt_destroy_ch_ib(ch); srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring, @@ -2047,11 +2060,6 @@ static void srpt_release_channel_work(struct work_struct *w) sdev, ch->rq_size, srp_max_req_size, DMA_FROM_DEVICE); - sport = ch->sport; - mutex_lock(&sport->mutex); - list_del_rcu(&ch->list); - mutex_unlock(&sport->mutex); - wake_up(&sport->ch_releaseQ); kref_put(&ch->kref, srpt_free_ch);