iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Bart Van Assche a1ae7d0345 RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access 
This patch fixes the following KASAN complaint:

==================================================================
BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x77d/0x9b0 [rdma_rxe]
Read of size 8 at addr ffff880061aef860 by task 01/1080

CPU: 2 PID: 1080 Comm: 01 Not tainted 4.16.0-rc3-dbg+ #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
Call Trace:
dump_stack+0x85/0xc7
print_address_description+0x65/0x270
kasan_report+0x231/0x350
rxe_post_send+0x77d/0x9b0 [rdma_rxe]
__ib_drain_sq+0x1ad/0x250 [ib_core]
ib_drain_qp+0x9/0x30 [ib_core]
srp_destroy_qp+0x51/0x70 [ib_srp]
srp_free_ch_ib+0xfc/0x380 [ib_srp]
srp_create_target+0x1071/0x19e0 [ib_srp]
kernfs_fop_write+0x180/0x210
__vfs_write+0xb1/0x2e0
vfs_write+0xf6/0x250
SyS_write+0x99/0x110
do_syscall_64+0xee/0x2b0
entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the page:
page:ffffea000186bbc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x4000000000000000()
raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffffea000186bbe0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff880061aef700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff880061aef780: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
>ffff880061aef800: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2
                                                      ^
ffff880061aef880: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 f2 f2
ffff880061aef900: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Fixes: 765d67748bcf ("IB: new common API for draining queues")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Cc: Steve Wise <swise@opengridcomputing.com>
Cc: Sagi Grimberg <sagi@grimberg.me>
Cc: stable@vger.kernel.org
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2018-03-06 16:00:51 -07:00
..
accessibility
…
acpi
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
amba
…
android
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
ata
pci-v4.16-changes
2018-02-06 09:59:40 -08:00
atm
atm: he: use 64-bit arithmetic instead of 32-bit
2018-02-08 15:05:16 -05:00
auxdisplay
…
base
More power management updates for v4.16-rc1
2018-02-09 09:40:33 -08:00
bcma
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-01-19 22:59:33 -05:00
block
Things have been very quiet on the rbd side, as work continues on the
2018-02-08 11:38:59 -08:00
bluetooth
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
bus
ARM: SoC driver updates for 4.16
2018-02-01 16:35:31 -08:00
cdrom
…
char
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
clk
MIPS changes for 4.16
2018-02-07 11:22:44 -08:00
clocksource
…
connector
…
cpufreq
arm: imx: Add MODULE_ALIAS for cpufreq
2018-02-08 10:21:39 +01:00
cpuidle
powerpc updates for 4.16
2018-02-02 10:01:04 -08:00
crypto
KVM changes for 4.16
2018-02-10 13:16:35 -08:00
dax
Merge branch 'for-4.16/dax' into libnvdimm-for-next
2018-02-03 00:26:10 -07:00
dca
…
devfreq
…
dio
…
dma
Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm
2018-02-02 09:50:51 -08:00
dma-buf
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
edac
…
eisa
EISA: Delete error message for a failed memory allocation in eisa_probe()
2018-01-23 09:04:10 +01:00
extcon
…
firewire
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
firmware
2nd set of arm64 updates for 4.16:
2018-02-08 10:44:25 -08:00
fmc
…
fpga
…
fsi
…
gpio
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
gpu
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
hid
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
hsi
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
hv
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
hwmon
hwmon: (dell-smm) Disable fan support for Dell Vostro 3360
2018-01-27 09:34:22 -08:00
hwspinlock
…
hwtracing
Char/Misc driver patches for 4.16-rc1
2018-02-01 10:31:17 -08:00
i2c
Merge branch 'i2c/for-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
2018-02-04 10:57:43 -08:00
ide
pci-v4.16-changes
2018-02-06 09:59:40 -08:00
idle
…
iio
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
infiniband
RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access
2018-03-06 16:00:51 -07:00
input
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
iommu
IOMMU Updates for Linux v4.16
2018-02-08 12:03:54 -08:00
ipack
…
irqchip
pci-v4.16-changes
2018-02-06 09:59:40 -08:00
isdn
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
leds
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
lightnvm
…
macintosh
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
mailbox
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
mcb
…
md
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
media
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
memory
ARM: SoC driver updates for 4.16
2018-02-01 16:35:31 -08:00
memstick
…
message
scsi: mptsas: remove duplicated assignment to pointer head
2018-01-17 01:19:38 -05:00
mfd
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
misc
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
mmc
Kbuild updates for v4.16 (2nd)
2018-02-09 19:32:41 -08:00
mtd
dma mapping changes for Linux 4.16:
2018-01-31 11:32:27 -08:00
mux
Char/Misc driver patches for 4.16-rc1
2018-02-01 10:31:17 -08:00
net
net/mlx5: E-Switch, Reload IB interface when switching devlink modes
2018-02-23 12:36:39 -08:00
nfc
…
ntb
NTB: ntb_perf: fix cast to restricted __le32
2018-01-28 22:17:24 -05:00
nubus
nubus: Add support for the driver model
2018-01-16 16:47:29 +01:00
nvdimm
Merge branch 'for-4.16/nfit' into libnvdimm-for-next
2018-02-03 00:26:26 -07:00
nvme
for-linus-20180204
2018-02-04 11:16:35 -08:00
nvmem
…
of
pci-v4.16-changes
2018-02-06 09:59:40 -08:00
opp
…
oprofile
…
parisc
…
parport
…
pci
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
pcmcia
Merge branch 'pcmcia' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia
2018-02-08 11:48:49 -08:00
perf
bitmap: replace bitmap_{from,to}_u32array
2018-02-06 18:32:44 -08:00
phy
USB/PHY updates for 4.16-rc1
2018-02-01 09:40:49 -08:00
pinctrl
This is the bulk of pin control changes for the v4.16 kernel cycle:
2018-02-02 14:22:53 -08:00
platform
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
pnp
…
power
power supply and reset changes for the v4.16 series
2018-01-31 12:55:31 -08:00
powercap
powercap: intel_rapl: Fix trailing semicolon
2018-01-17 12:56:24 +01:00
pps
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
ps3
…
ptp
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
pwm
…
rapidio
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
ras
mm/memory_failure: Remove unused trapno from memory_failure
2018-01-23 12:17:42 -06:00
regulator
regulator: Fix suspend to idle
2018-01-30 12:25:59 +00:00
remoteproc
remoteproc updates for v4.16
2018-02-05 10:07:40 -08:00
reset
…
rpmsg
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
rtc
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
s390
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
sbus
pci-v4.16-changes
2018-02-06 09:59:40 -08:00
scsi
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
sfi
…
sh
cpufreq: Add and use cpufreq_for_each_{valid_,}entry_idx()
2018-02-08 10:21:39 +01:00
siox
…
slimbus
…
sn
…
soc
ARM: SoC driver updates for 4.16
2018-02-01 16:35:31 -08:00
soundwire
soundwire: Fix a signedness bug
2018-01-22 16:45:26 +01:00
spi
Merge remote-tracking branch 'spi/topic/xilinx' into spi-next
2018-01-26 17:57:34 +00:00
spmi
…
ssb
Merge git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
2018-02-01 10:37:39 +02:00
staging
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
target
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
2018-02-09 14:49:46 -08:00
tc
…
tee
…
thermal
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux
2018-02-06 15:04:58 -08:00
thunderbolt
…
tty
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
uio
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
usb
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
uwb
…
vfio
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
vhost
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
video
Kbuild updates for v4.16 (2nd)
2018-02-09 19:32:41 -08:00
virt
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
virtio
virtio_pci: don't kfree device on register failure
2018-02-01 16:26:45 +02:00
visorbus
…
vlynq
…
vme
…
w1
Documentation updates for 4.16. New stuff includes refcount_t
2018-01-31 19:25:25 -08:00
watchdog
linux-watchdog 4.16-rc1 merge window tag
2018-02-07 11:54:34 -08:00
xen
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
zorro
…
Kconfig
Char/Misc driver patches for 4.16-rc1
2018-02-01 10:31:17 -08:00
Makefile
pci-v4.16-changes
2018-02-06 09:59:40 -08:00