• Avihai Horon's avatar
    RDMA/core: Fix invalid memory access in spec_filter_size · a72f4ac1
    Avihai Horon authored
    Add a check that the size specified in the flow spec header doesn't cause
    an overflow when calculating the filter size, and thus prevent access to
    invalid memory.  The following crash from syzkaller revealed it.
    
      kasan: CONFIG_KASAN_INLINE enabled
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] SMP KASAN PTI
      CPU: 1 PID: 17834 Comm: syz-executor.3 Not tainted 5.5.0-rc5 #2
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
      rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      RIP: 0010:memchr_inv+0xd3/0x330
      Code: 89 f9 89 f5 83 e1 07 0f 85 f9 00 00 00 49 89 d5 49 c1 ed 03 45 85
      ed 74 6f 48 89 d9 48 b8 00 00 00 00 00 fc ff df 48 c1 e9 03 <80> 3c 01
      00 0f 85 0d 02 00 00 44 0f b6 e5 48 b8 01 01 01 01 01 01
      RSP: 0018:ffffc9000a13fa50 EFLAGS: 00010202
      RAX: dffffc0000000000 RBX: 7fff88810de9d820 RCX: 0ffff11021bd3b04
      RDX: 000000000000fff8 RSI: 0000000000000000 RDI: 7fff88810de9d820
      RBP: 0000000000000000 R08: ffff888110d69018 R09: 0000000000000009
      R10: 0000000000000001 R11: ffffed10236267cc R12: 0000000000000004
      R13: 0000000000001fff R14: ffff88810de9d820 R15: 0000000000000040
      FS:  00007f9ee0e51700(0000) GS:ffff88811b100000(0000)
      knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000000 CR3: 0000000115ea0006 CR4: 0000000000360ee0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       spec_filter_size.part.16+0x34/0x50
       ib_uverbs_kern_spec_to_ib_spec_filter+0x691/0x770
       ib_uverbs_ex_create_flow+0x9ea/0x1b40
       ib_uverbs_write+0xaa5/0xdf0
       __vfs_write+0x7c/0x100
       vfs_write+0x168/0x4a0
       ksys_write+0xc8/0x200
       do_syscall_64+0x9c/0x390
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      RIP: 0033:0x465b49
      Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89
      f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
      f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007f9ee0e50c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000465b49
      RDX: 00000000000003a0 RSI: 00000000200007c0 RDI: 0000000000000004
      RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9ee0e516bc
      R13: 00000000004ca2da R14: 000000000070deb8 R15: 00000000ffffffff
      Modules linked in:
      Dumping ftrace buffer:
         (ftrace buffer empty)
    
    Fixes: 94e03f11 ("IB/uverbs: Add support for flow tag")
    Link: https://lore.kernel.org/r/20200126171500.4623-1-leon@kernel.orgSigned-off-by: default avatarAvihai Horon <avihaih@mellanox.com>
    Reviewed-by: default avatarMaor Gottlieb <maorg@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
    Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    a72f4ac1
uverbs_cmd.c 107 KB