releases/4.18.14/ucma-fix-a-use-after-free-in-ucma_resolve_ip.patch

   1 From 5fe23f262e0548ca7f19fb79f89059a60d087d22 Mon Sep 17 00:00:00 2001
   2 From: Cong Wang <xiyou.wangcong@gmail.com>
   3 Date: Wed, 12 Sep 2018 16:27:44 -0700
   4 Subject: ucma: fix a use-after-free in ucma_resolve_ip()
   5
   6 From: Cong Wang <xiyou.wangcong@gmail.com>
   7
   8 commit 5fe23f262e0548ca7f19fb79f89059a60d087d22 upstream.
   9
  10 There is a race condition between ucma_close() and ucma_resolve_ip():
  11
  12 CPU0                            CPU1
  13 ucma_resolve_ip():              ucma_close():
  14
  15 ctx = ucma_get_ctx(file, cmd.id);
  16
  17         list_for_each_entry_safe(ctx, tmp, &file->ctx_list, list) {
  18                 mutex_lock(&mut);
  19                 idr_remove(&ctx_idr, ctx->id);
  20                 mutex_unlock(&mut);
  21                 ...
  22                 mutex_lock(&mut);
  23                 if (!ctx->closing) {
  24                         mutex_unlock(&mut);
  25                         rdma_destroy_id(ctx->cm_id);
  26                 ...
  27                 ucma_free_ctx(ctx);
  28
  29 ret = rdma_resolve_addr();
  30 ucma_put_ctx(ctx);
  31
  32 Before idr_remove(), ucma_get_ctx() could still find the ctx
  33 and after rdma_destroy_id(), rdma_resolve_addr() may still
  34 access id_priv pointer. Also, ucma_put_ctx() may use ctx after
  35 ucma_free_ctx() too.
  36
  37 ucma_close() should call ucma_put_ctx() too which tests the
  38 refcnt and waits for the last one releasing it. The similar
  39 pattern is already used by ucma_destroy_id().
  40
  41 Reported-and-tested-by: syzbot+da2591e115d57a9cbb8b@syzkaller.appspotmail.com
  42 Reported-by: syzbot+cfe3c1e8ef634ba8964b@syzkaller.appspotmail.com
  43 Cc: Jason Gunthorpe <jgg@mellanox.com>
  44 Cc: Doug Ledford <dledford@redhat.com>
  45 Cc: Leon Romanovsky <leon@kernel.org>
  46 Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
  47 Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
  48 Signed-off-by: Doug Ledford <dledford@redhat.com>
  49 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  50
  51 ---
  52  drivers/infiniband/core/ucma.c |    2 ++
  53  1 file changed, 2 insertions(+)
  54
  55 --- a/drivers/infiniband/core/ucma.c
  56 +++ b/drivers/infiniband/core/ucma.c
  57 @@ -1759,6 +1759,8 @@ static int ucma_close(struct inode *inod
  58                 mutex_lock(&mut);
  59                 if (!ctx->closing) {
  60                         mutex_unlock(&mut);
  61 +                       ucma_put_ctx(ctx);
  62 +                       wait_for_completion(&ctx->comp);
  63                         /* rdma_destroy_id ensures that no event handlers are
  64                          * inflight for that id before releasing it.
  65                          */