From patchwork Thu Jun 23 19:52:56 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Jurgens X-Patchwork-Id: 9195969 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 893DF6075A for ; Thu, 23 Jun 2016 20:05:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7978F2846B for ; Thu, 23 Jun 2016 20:05:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6E78A28473; Thu, 23 Jun 2016 20:05:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (emsm-gh1-uea10.nsa.gov [8.44.101.8]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8890E2846B for ; Thu, 23 Jun 2016 20:05:28 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.26,518,1459814400"; d="scan'208";a="14966485" IronPort-PHdr: =?us-ascii?q?9a23=3AKF4Iyh3qKGbTJNrrsmDT+DRfVm0co7zxezQtwd8Z?= =?us-ascii?q?sekRIvad9pjvdHbS+e9qxAeQG96Ks7Qc1KGO7ujJYi8p2d65qncMcZhBBVcuqP?= =?us-ascii?q?49uEgeOvODElDxN/XwbiY3T4xoXV5h+GynYwAOQJ6tL2PbrnD61zMOABK3bVMz?= =?us-ascii?q?fbWtXNaNxJzqn8mJuLTrKz1SgzS8Zb4gZD6Xli728vcsvI15N6wqwQHIqHYbM8?= =?us-ascii?q?5fxGdvOE7B102kvpT4wYRnuxh0l7phspcYEPayQ6NtRrxCDS85G3sy+daurh7H?= =?us-ascii?q?CwyV6T9USmwLljJQChXBqRT9WY389CD9s641wyWBFdHnRrAzHzK55uFkTwGswC?= =?us-ascii?q?ofPiQ460nPg9Zxl7pfqRms4RtlzMqcbIWYOPR5ZK/1Z94WRWNdGM1WUmgJGY61?= =?us-ascii?q?ac0PAuQdLM5ZqZXwox0Fqh76TQmlAKX1zSRFgGTq2qY5++skGADCmgcnGoEgqn?= =?us-ascii?q?PR+fn8Mu8wTPq6wa/ThWHPZvVX1DP/wI3FdhQop/acG7l3dJyCmgEUCwrZgwDI?= =?us-ascii?q?+sTeNDSP27FI6jCW?= X-IPAS-Result: =?us-ascii?q?A2H/BADUP2xX/wHyM5BdHQGDIIFTvCwfhzJMAQEBAQEBAgJ?= =?us-ascii?q?iJ4IyghsCBAECJBMUIAsDAwkBARcIIQgIAwEtFREHBwsFGASIDwTHKwELASSMP?= =?us-ascii?q?oJIEQGFdwWOaYoWjjOJXIVGj35UgggcgU9riD4NFweBFwEBAQ?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 23 Jun 2016 20:05:20 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5NK5Jfq005172; Thu, 23 Jun 2016 16:05:20 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u5NJxbcP212571 for ; Thu, 23 Jun 2016 15:59:37 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u5NJxagW003606 for ; Thu, 23 Jun 2016 15:59:36 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AnBQAZP2xX/4GlL8FdHQGDIIFTuCuECYYYAoEvTAEBAQEBAWYnhE0CBCdSEBgIMVcHEog0xyoBAQgnjD6IUQWOaYoWjjOJXIVGj35UgggcgU85Mog+K4EXAQEB X-IPAS-Result: A1AnBQAZP2xX/4GlL8FdHQGDIIFTuCuECYYYAoEvTAEBAQEBAWYnhE0CBCdSEBgIMVcHEog0xyoBAQgnjD6IUQWOaYoWjjOJXIVGj35UgggcgU85Mog+K4EXAQEB X-IronPort-AV: E=Sophos;i="5.26,518,1459828800"; d="scan'208";a="5538193" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 23 Jun 2016 15:59:04 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3AqkVFexEzcTLr2037Vhnei51GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ74r8mwAkXT6L1XgUPTWs2DsrQf2rKQ6/+rATFIyK3CmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TWM5DIfUi/yKRBy?= =?us-ascii?q?brysXNWD14LviKvqptX6WEZhvHKFe7R8LRG7/036l/I9ps9cEJs30QbDuXBSeu?= =?us-ascii?q?5blitCLFOXmAvgtI/rpMYwuwwZgf8q9tZBXKPmZOx4COUAVHV1e1wyscbrrxjY?= =?us-ascii?q?UiOU4WYHF34RllxPGQeBpAnzQ5PZqiLnsq943y6AMIv9SrVwES+u9I93WRToj2?= =?us-ascii?q?EBLDd//2bJzoR9lKtBoQmJvxVlwpXMZIieObx5ZKyZNd8eSGZPWdxdfzZMDoO1?= =?us-ascii?q?c80ECO9Fdf1Vpo+7p1YAsQqWBA+wCeepwThNwjf21Kl8yeM6HAfdwAsrHPoBtX?= =?us-ascii?q?3VqJP+M6JBf/qyyfzkxDOLTe5M1jr788CcfhknoPyIX5p1fM7VwE8oB0XOiVDG?= =?us-ascii?q?+t+tBC+cyulY6zvT1OFnT+/6zjd/8ww=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0EYBQCo7GpX/4GlL8FeHoMggVO4JoQJh?= =?us-ascii?q?hcCgTBMAQEBAQEBAgJiJ4IyghsCBCdSEBgIMVcHEog0xREBAQgnjD6IUQWOaIo?= =?us-ascii?q?Vji+JW4VGj3xUgggcgU85MokvK4EXAQEB?= X-IPAS-Result: =?us-ascii?q?A0EYBQCo7GpX/4GlL8FeHoMggVO4JoQJhhcCgTBMAQEBAQE?= =?us-ascii?q?BAgJiJ4IyghsCBCdSEBgIMVcHEog0xREBAQgnjD6IUQWOaIoVji+JW4VGj3xUg?= =?us-ascii?q?ggcgU85MokvK4EXAQEB?= X-IronPort-AV: E=Sophos;i="5.26,518,1459814400"; d="scan'208";a="17160175" Received: from unknown (HELO mellanox.co.il) ([193.47.165.129]) by emsm-gh1-uea11.nsa.gov with ESMTP; 23 Jun 2016 19:59:02 +0000 Received: from Internal Mail-Server by MTLPINE1 (envelope-from danielj@mellanox.com) with ESMTPS (AES256-SHA encrypted); 23 Jun 2016 22:53:49 +0300 Received: from x-vnc01.mtx.labs.mlnx (x-vnc01.mtx.labs.mlnx [10.12.150.16]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id u5NJr2DJ029223; Thu, 23 Jun 2016 22:53:47 +0300 From: Dan Jurgens To: chrisw@sous-sol.org, paul@paul-moore.com, sds@tycho.nsa.gov, eparis@parisplace.org, dledford@redhat.com, sean.hefty@intel.com, hal.rosenstock@gmail.com Subject: [PATCH 10/12] IB/core: Enforce PKey security on management datagrams Date: Thu, 23 Jun 2016 22:52:56 +0300 Message-Id: <1466711578-64398-11-git-send-email-danielj@mellanox.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1466711578-64398-1-git-send-email-danielj@mellanox.com> References: <1466711578-64398-1-git-send-email-danielj@mellanox.com> X-Mailman-Approved-At: Thu, 23 Jun 2016 16:01:54 -0400 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: linux-rdma@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP From: Daniel Jurgens Allocate and free a security context when creating and destroying a MAD agent. This context is used for controlling access to PKeys. When sending or receiving a MAD check that the agent has permission to access the PKey for the Subnet Prefix of the port. Signed-off-by: Daniel Jurgens Reviewed-by: Eli Cohen Reviewed-by: Leon Romanovsky --- drivers/infiniband/core/core_priv.h | 13 ++++++++ drivers/infiniband/core/mad.c | 63 ++++++++++++++++++++++++++++++++----- drivers/infiniband/core/security.c | 24 ++++++++++++++ 3 files changed, 93 insertions(+), 7 deletions(-) diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h index 68e3de0..8ab8d58 100644 --- a/drivers/infiniband/core/core_priv.h +++ b/drivers/infiniband/core/core_priv.h @@ -166,6 +166,11 @@ int ib_get_cached_subnet_prefix(struct ib_device *device, u64 *sn_pfx); #ifdef CONFIG_SECURITY_INFINIBAND +int ib_security_ma_pkey_access(struct ib_device *dev, + u8 port_num, + u16 pkey_index, + struct ib_mad_agent *mad_agent); + void ib_security_destroy_port_pkey_list(struct ib_device *device); void ib_security_cache_change(struct ib_device *device, @@ -184,6 +189,14 @@ void ib_destroy_qp_security_end(struct ib_qp_security *sec); int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev); void ib_close_shared_qp_security(struct ib_qp_security *sec); #else +static inline int ib_security_ma_pkey_access(struct ib_device *dev, + u8 port_num, + u16 pkey_index, + struct ib_mad_agent *mad_agent) +{ + return 0; +} + static inline void ib_security_destroy_port_pkey_list(struct ib_device *device) { } diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c index 82fb511..975b472 100644 --- a/drivers/infiniband/core/mad.c +++ b/drivers/infiniband/core/mad.c @@ -40,9 +40,11 @@ #include #include #include +#include #include #include "mad_priv.h" +#include "core_priv.h" #include "mad_rmpp.h" #include "smi.h" #include "opa_smi.h" @@ -337,11 +339,17 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device, goto error1; } + ret2 = security_ib_mad_agent_alloc_security(&mad_agent_priv->agent); + if (ret2) { + ret = ERR_PTR(ret2); + goto error3; + } + if (mad_reg_req) { reg_req = kmemdup(mad_reg_req, sizeof *reg_req, GFP_KERNEL); if (!reg_req) { ret = ERR_PTR(-ENOMEM); - goto error3; + goto error4; } } @@ -384,7 +392,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device, if (method) { if (method_in_use(&method, mad_reg_req)) - goto error4; + goto error5; } } ret2 = add_nonoui_reg_req(mad_reg_req, mad_agent_priv, @@ -400,14 +408,14 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device, if (is_vendor_method_in_use( vendor_class, mad_reg_req)) - goto error4; + goto error5; } } ret2 = add_oui_reg_req(mad_reg_req, mad_agent_priv); } if (ret2) { ret = ERR_PTR(ret2); - goto error4; + goto error5; } } @@ -417,9 +425,11 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device, return &mad_agent_priv->agent; -error4: +error5: spin_unlock_irqrestore(&port_priv->reg_lock, flags); kfree(reg_req); +error4: + security_ib_mad_agent_free_security(&mad_agent_priv->agent); error3: kfree(mad_agent_priv); error1: @@ -489,6 +499,7 @@ struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device, struct ib_mad_agent *ret; struct ib_mad_snoop_private *mad_snoop_priv; int qpn; + int err; /* Validate parameters */ if ((is_snooping_sends(mad_snoop_flags) && !snoop_handler) || @@ -513,6 +524,13 @@ struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device, goto error1; } + err = security_ib_mad_agent_alloc_security(&mad_snoop_priv->agent); + + if (err) { + ret = ERR_PTR(err); + goto error2; + } + /* Now, fill in the various structures */ mad_snoop_priv->qp_info = &port_priv->qp_info[qpn]; mad_snoop_priv->agent.device = device; @@ -523,17 +541,19 @@ struct ib_mad_agent *ib_register_mad_snoop(struct ib_device *device, mad_snoop_priv->agent.port_num = port_num; mad_snoop_priv->mad_snoop_flags = mad_snoop_flags; init_completion(&mad_snoop_priv->comp); + mad_snoop_priv->snoop_index = register_snoop_agent( &port_priv->qp_info[qpn], mad_snoop_priv); if (mad_snoop_priv->snoop_index < 0) { ret = ERR_PTR(mad_snoop_priv->snoop_index); - goto error2; + goto error3; } atomic_set(&mad_snoop_priv->refcount, 1); return &mad_snoop_priv->agent; - +error3: + security_ib_mad_agent_free_security(&mad_snoop_priv->agent); error2: kfree(mad_snoop_priv); error1: @@ -579,6 +599,8 @@ static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv) deref_mad_agent(mad_agent_priv); wait_for_completion(&mad_agent_priv->comp); + security_ib_mad_agent_free_security(&mad_agent_priv->agent); + kfree(mad_agent_priv->reg_req); kfree(mad_agent_priv); } @@ -597,6 +619,8 @@ static void unregister_mad_snoop(struct ib_mad_snoop_private *mad_snoop_priv) deref_snoop_agent(mad_snoop_priv); wait_for_completion(&mad_snoop_priv->comp); + security_ib_mad_agent_free_security(&mad_snoop_priv->agent); + kfree(mad_snoop_priv); } @@ -1216,6 +1240,7 @@ int ib_post_send_mad(struct ib_mad_send_buf *send_buf, struct ib_mad_send_wr_private *mad_send_wr; unsigned long flags; int ret = -EINVAL; + u16 pkey_index; /* Walk list of send WRs and post each on send list */ for (; send_buf; send_buf = next_send_buf) { @@ -1224,6 +1249,15 @@ int ib_post_send_mad(struct ib_mad_send_buf *send_buf, struct ib_mad_send_wr_private, send_buf); mad_agent_priv = mad_send_wr->mad_agent_priv; + pkey_index = mad_send_wr->send_wr.pkey_index; + + ret = ib_security_ma_pkey_access(mad_agent_priv->agent.device, + mad_agent_priv->agent.port_num, + pkey_index, + &mad_agent_priv->agent); + + if (ret) + goto error; if (!send_buf->mad_agent->send_handler || (send_buf->timeout_ms && @@ -1958,6 +1992,15 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, struct ib_mad_send_wr_private *mad_send_wr; struct ib_mad_send_wc mad_send_wc; unsigned long flags; + int ret; + + ret = ib_security_ma_pkey_access(mad_agent_priv->agent.device, + mad_agent_priv->agent.port_num, + mad_recv_wc->wc->pkey_index, + &mad_agent_priv->agent); + + if (ret) + goto security_error; INIT_LIST_HEAD(&mad_recv_wc->rmpp_list); list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list); @@ -2015,6 +2058,12 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, mad_recv_wc); deref_mad_agent(mad_agent_priv); } + + return; + +security_error: + ib_free_recv_mad(mad_recv_wc); + deref_mad_agent(mad_agent_priv); } static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv, diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c index 71a72e7..f88b328 100644 --- a/drivers/infiniband/core/security.c +++ b/drivers/infiniband/core/security.c @@ -614,4 +614,28 @@ int ib_security_modify_qp(struct ib_qp *qp, } EXPORT_SYMBOL(ib_security_modify_qp); +int ib_security_ma_pkey_access(struct ib_device *dev, + u8 port_num, + u16 pkey_index, + struct ib_mad_agent *mad_agent) +{ + u64 subnet_prefix; + u16 pkey; + int ret; + + ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey); + if (ret) + return ret; + + ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix); + + if (ret) + return ret; + + return security_ib_mad_agent_pkey_access(subnet_prefix, + pkey, + mad_agent); +} +EXPORT_SYMBOL(ib_security_ma_pkey_access); + #endif /* CONFIG_SECURITY_INFINIBAND */