[5.10,012/104] RDMA/core: Dont access cm_id after its destruction

From: Shay Drory <shayd@nvidia.com>

From: Shay Drory <shayd@nvidia.com>

[ Upstream commit 889d916b6f8a48b8c9489fffcad3b78eedd01a51 ]

restrack should only be attached to a cm_id while the ID has a valid
device pointer. It is set up when the device is first loaded, but not
cleared when the device is removed. There is also two copies of the device
pointer, one private and one in the public API, and these were left out of
sync.

Make everything go to NULL together and manipulate restrack right around
the device assignments.

Found by syzcaller:
BUG: KASAN: wild-memory-access in __list_del include/linux/list.h:112 [inline]
BUG: KASAN: wild-memory-access in __list_del_entry include/linux/list.h:135 [inline]
BUG: KASAN: wild-memory-access in list_del include/linux/list.h:146 [inline]
BUG: KASAN: wild-memory-access in cma_cancel_listens drivers/infiniband/core/cma.c:1767 [inline]
BUG: KASAN: wild-memory-access in cma_cancel_operation drivers/infiniband/core/cma.c:1795 [inline]
BUG: KASAN: wild-memory-access in cma_cancel_operation+0x1f4/0x4b0 drivers/infiniband/core/cma.c:1783
Write of size 8 at addr dead000000000108 by task syz-executor716/334

CPU: 0 PID: 334 Comm: syz-executor716 Not tainted 5.11.0+ #271
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xbe/0xf9 lib/dump_stack.c:120
 __kasan_report mm/kasan/report.c:400 [inline]
 kasan_report.cold+0x5f/0xd5 mm/kasan/report.c:413
 __list_del include/linux/list.h:112 [inline]
 __list_del_entry include/linux/list.h:135 [inline]
 list_del include/linux/list.h:146 [inline]
 cma_cancel_listens drivers/infiniband/core/cma.c:1767 [inline]
 cma_cancel_operation drivers/infiniband/core/cma.c:1795 [inline]
 cma_cancel_operation+0x1f4/0x4b0 drivers/infiniband/core/cma.c:1783
 _destroy_id+0x29/0x460 drivers/infiniband/core/cma.c:1862
 ucma_close_id+0x36/0x50 drivers/infiniband/core/ucma.c:185
 ucma_destroy_private_ctx+0x58d/0x5b0 drivers/infiniband/core/ucma.c:576
 ucma_close+0x91/0xd0 drivers/infiniband/core/ucma.c:1797
 __fput+0x169/0x540 fs/file_table.c:280
 task_work_run+0xb7/0x100 kernel/task_work.c:140
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0x7da/0x17f0 kernel/exit.c:825
 do_group_exit+0x9e/0x190 kernel/exit.c:922
 __do_sys_exit_group kernel/exit.c:933 [inline]
 __se_sys_exit_group kernel/exit.c:931 [inline]
 __x64_sys_exit_group+0x2d/0x30 kernel/exit.c:931
 do_syscall_64+0x2d/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 255d0c14b375 ("RDMA/cma: rdma_bind_addr() leaks a cma_dev reference count")
Link: https://lore.kernel.org/r/3352ee288fe34f2b44220457a29bfc0548686363.1620711734.git.leonro@nvidia.com
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Message ID	20210524152333.237091376@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Shay Drory <shayd@nvidia.com>, Leon Romanovsky <leonro@nvidia.com>, Jason Gunthorpe <jgg@nvidia.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 012/104] RDMA/core: Dont access cm_id after its destruction Date: Mon, 24 May 2021 17:25:07 +0200 Message-Id: <20210524152333.237091376@linuxfoundation.org> In-Reply-To: <20210524152332.844251980@linuxfoundation.org> References: <20210524152332.844251980@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/104] openrisc: Fix a memory leak [5.10,003/104] tee: amdtee: unload TA only when its refcount becomes 0 [5.10,004/104] RDMA/siw: Properly check send and receive CQ pointers [5.10,005/104] RDMA/siw: Release xarray entry [5.10,006/104] RDMA/core: Prevent divide-by-zero error triggered by the user [5.10,007/104] RDMA/rxe: Clear all QP fields if creation failed [5.10,008/104] scsi: ufs: core: Increase the usable queue depth [5.10,009/104] scsi: qedf: Add pointer checks in qedf_update_link_speed() [5.10,010/104] scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() [5.10,011/104] RDMA/mlx5: Recover from fatal event in dual port mode [5.10,012/104] RDMA/core: Dont access cm_id after its destruction [5.10,013/104] nvmet: remove unused ctrl->cqs [5.10,014/104] nvmet: fix memory leak in nvmet_alloc_ctrl() [5.10,015/104] nvme-loop: fix memory leak in nvme_loop_create_ctrl() [5.10,016/104] nvme-tcp: rerun io_work if req_list is not empty [5.10,017/104] nvme-fc: clear q_live at beginning of association teardown [5.10,018/104] platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue [5.10,019/104] platform/x86: intel_int0002_vgpio: Only call enable_irq_wake() when using s2idle [5.10,020/104] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios [5.10,021/104] RDMA/mlx5: Fix query DCT via DEVX [5.10,022/104] RDMA/uverbs: Fix a NULL vs IS_ERR() bug [5.10,023/104] tools/testing/selftests/exec: fix link error [5.10,024/104] powerpc/pseries: Fix hcall tracing recursion in pv queued spinlocks [5.10,025/104] ptrace: make ptrace() fail if the tracee changed its pid unexpectedly [5.10,026/104] nvmet: seset ns->file when open fails [5.10,027/104] perf/x86: Avoid touching LBR_TOS MSR for Arch LBR [5.10,028/104] locking/lockdep: Correct calling tracepoints [5.10,029/104] locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal [5.10,030/104] powerpc: Fix early setup to make early_ioremap() work [5.10,031/104] btrfs: avoid RCU stalls while running delayed iputs [5.10,032/104] cifs: fix memory leak in smb2_copychunk_range [5.10,033/104] misc: eeprom: at24: check suspend status before disable regulator [5.10,034/104] ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling tran... [5.10,035/104] ALSA: intel8x0: Dont update period unless prepared [5.10,036/104] ALSA: firewire-lib: fix amdtp_packet tracepoints event for packet_index field [5.10,037/104] ALSA: line6: Fix racy initialization of LINE6 MIDI [5.10,038/104] ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 [5.10,039/104] ALSA: firewire-lib: fix calculation for size of IR context payload [5.10,040/104] ALSA: usb-audio: Validate MS endpoint descriptors [5.10,041/104] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro [5.10,042/104] ALSA: hda: fixup headset for ASUS GU502 laptop [5.10,043/104] Revert "ALSA: sb8: add a check for request_region" [5.10,044/104] ALSA: firewire-lib: fix check for the size of isochronous packet payload [5.10,045/104] ALSA: hda/realtek: reset eapd coeff to default value for alc287 [5.10,046/104] ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 [5.10,047/104] ALSA: hda/realtek: Fix silent headphone output on ASUS UX430UA [5.10,048/104] ALSA: hda/realtek: Add fixup for HP OMEN laptop [5.10,049/104] ALSA: hda/realtek: Add fixup for HP Spectre x360 15-df0xxx [5.10,050/104] uio_hv_generic: Fix a memory leak in error handling paths [5.10,051/104] Revert "rapidio: fix a NULL pointer dereference when create_workqueue() fails" [5.10,052/104] rapidio: handle create_workqueue() failure [5.10,053/104] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference" [5.10,054/104] nvme-tcp: fix possible use-after-completion [5.10,055/104] x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch [5.10,056/104] x86/sev-es: Invalidate the GHCB after completing VMGEXIT [5.10,057/104] x86/sev-es: Dont return NULL from sev_es_get_ghcb() [5.10,058/104] x86/sev-es: Use __put_user()/__get_user() for data accesses [5.10,059/104] x86/sev-es: Forward page-faults which happen during emulation [5.10,060/104] drm/amdgpu: Fix GPU TLB update error when PAGE_SIZE > AMDGPU_PAGE_SIZE [5.10,061/104] drm/amdgpu: disable 3DCGCG on picasso/raven1 to avoid compute hang [5.10,062/104] drm/amdgpu: update gc golden setting for Navi12 [5.10,063/104] drm/amdgpu: update sdma golden setting for Navi12 [5.10,064/104] powerpc/64s/syscall: Use pt_regs.trap to distinguish syscall ABI difference betwee... [5.10,065/104] powerpc/64s/syscall: Fix ptrace syscall info with scv syscalls [5.10,066/104] mmc: sdhci-pci-gli: increase 1.8V regulator wait [5.10,067/104] xen-pciback: redo VF placement in the virtual topology [5.10,068/104] xen-pciback: reconfigure also from backend watch handler [5.10,069/104] ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry [5.10,070/104] dm snapshot: fix a crash when an origin has no snapshots [5.10,071/104] dm snapshot: fix crash with transient storage and zero chunk size [5.10,072/104] kcsan: Fix debugfs initcall return type [5.10,073/104] Revert "video: hgafb: fix potential NULL pointer dereference" [5.10,074/104] Revert "net: stmicro: fix a missing check of clk_prepare" [5.10,075/104] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" [5.10,076/104] Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" [5.10,077/104] Revert "video: imsttfb: fix potential NULL pointer dereferences" [5.10,078/104] Revert "ecryptfs: replace BUG_ON with error handling code" [5.10,079/104] Revert "scsi: ufs: fix a missing check of devm_reset_control_get" [5.10,080/104] Revert "gdrom: fix a memory leak bug" [5.10,081/104] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom [5.10,082/104] cdrom: gdrom: initialize global variable at init time [5.10,083/104] Revert "media: rcar_drif: fix a memory disclosure" [5.10,084/104] Revert "rtlwifi: fix a potential NULL pointer dereference" [5.10,085/104] Revert "qlcnic: Avoid potential NULL pointer dereference" [5.10,086/104] Revert "niu: fix missing checks of niu_pci_eeprom_read" [5.10,087/104] ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() [5.10,088/104] net: stmicro: handle clk_prepare() failure during init [5.10,089/104] scsi: ufs: handle cleanup correctly on devm_reset_control_get error [5.10,090/104] net: rtlwifi: properly check for alloc_workqueue() failure [5.10,091/104] ics932s401: fix broken handling of errors when word reading fails [5.10,092/104] leds: lp5523: check return value of lp5xx_read and jump to cleanup code [5.10,093/104] qlcnic: Add null check after calling netdev_alloc_skb [5.10,094/104] video: hgafb: fix potential NULL pointer dereference [5.10,095/104] vgacon: Record video mode changes with VT_RESIZEX [5.10,096/104] vt_ioctl: Revert VT_RESIZEX parameter handling removal [5.10,097/104] vt: Fix character height handling with VT_RESIZEX [5.10,098/104] tty: vt: always invoke vc->vc_sw->con_resize callback [5.10,099/104] drm/i915/gt: Disable HiZ Raw Stall Optimization on broken gen7 [5.10,100/104] openrisc: mm/init.c: remove unused memblock_region variable in map_ram() [5.10,101/104] x86/Xen: swap NX determination and GDT setup on BSP [5.10,102/104] nvme-multipath: fix double initialization of ANA state [5.10,103/104] rtc: pcf85063: fallback to parent of_node [5.10,104/104] x86/boot/compressed/64: Check SEV encryption in the 32-bit boot-path

[5.10,012/104] RDMA/core: Dont access cm_id after its destruction

Commit Message

Patch