Leon Romanovsky
6f8b6627f3
RDMA/mlx5: Fix integer overflow while resizing CQ
commit 28e9091e31 upstream.
The user can provide very large cqe_size which will cause to integer
overflow as it can be seen in the following UBSAN warning:
=======================================================================
UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/cq.c:1192:53
signed integer overflow:
64870 * 65536 cannot be represented in type 'int'
CPU: 0 PID: 267 Comm: syzkaller605279 Not tainted 4.15.0+ #90 Hardware
name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Call Trace:
dump_stack+0xde/0x164
? dma_virt_map_sg+0x22c/0x22c
ubsan_epilogue+0xe/0x81
handle_overflow+0x1f3/0x251
? __ubsan_handle_negate_overflow+0x19b/0x19b
? lock_acquire+0x440/0x440
mlx5_ib_resize_cq+0x17e7/0x1e40
? cyc2ns_read_end+0x10/0x10
? native_read_msr_safe+0x6c/0x9b
? cyc2ns_read_end+0x10/0x10
? mlx5_ib_modify_cq+0x220/0x220
? sched_clock_cpu+0x18/0x200
? lookup_get_idr_uobject+0x200/0x200
? rdma_lookup_get_uobject+0x145/0x2f0
ib_uverbs_resize_cq+0x207/0x3e0
? ib_uverbs_ex_create_cq+0x250/0x250
ib_uverbs_write+0x7f9/0xef0
? cyc2ns_read_end+0x10/0x10
? print_irqtrace_events+0x280/0x280
? ib_uverbs_ex_create_cq+0x250/0x250
? uverbs_devnode+0x110/0x110
? sched_clock_cpu+0x18/0x200
? do_raw_spin_trylock+0x100/0x100
? __lru_cache_add+0x16e/0x290
__vfs_write+0x10d/0x700
? uverbs_devnode+0x110/0x110
? kernel_read+0x170/0x170
? sched_clock_cpu+0x18/0x200
? security_file_permission+0x93/0x260
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
? SyS_read+0x1a0/0x1a0
? trace_hardirqs_on_thunk+0x1a/0x1c
entry_SYSCALL_64_fastpath+0x1e/0x8b
RIP: 0033:0x433549
RSP: 002b:00007ffe63bd1ea8 EFLAGS: 00000217
=======================================================================
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # 3.13
Fixes: bde51583f4 ("IB/mlx5: Add support for resize CQ")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-18 11:17:48 +01:00
..
2018-02-16 20:09:47 +01:00
2018-02-28 10:17:23 +01:00
2018-02-16 20:09:42 +01:00
2017-12-16 10:33:55 +01:00
2018-01-31 12:06:08 +01:00
2017-03-12 06:37:30 +01:00
2018-02-16 20:09:47 +01:00
2018-02-16 20:09:46 +01:00
2018-01-10 09:27:09 +01:00
2018-03-11 16:19:44 +01:00
2017-12-20 10:04:59 +01:00
2017-10-27 10:23:17 +02:00
2018-03-11 16:19:44 +01:00
2017-12-25 14:22:15 +01:00
2018-02-25 11:03:55 +01:00
2018-02-22 15:44:58 +01:00
2018-02-25 11:03:50 +01:00
2018-02-16 20:09:47 +01:00
2017-11-21 09:21:18 +01:00
2016-11-10 16:36:35 +01:00
2017-12-20 10:04:56 +01:00
2018-02-25 11:03:50 +01:00
2018-03-03 10:19:44 +01:00
2018-02-28 10:17:23 +01:00
2018-02-25 11:03:46 +01:00
2018-02-03 17:04:28 +01:00
2016-02-25 12:01:23 -08:00
2017-12-20 10:04:54 +01:00
2018-02-25 11:03:48 +01:00
2018-02-25 11:03:51 +01:00
2018-02-28 10:17:22 +01:00
2018-03-18 11:17:48 +01:00
2018-02-25 11:03:49 +01:00
2018-01-17 09:35:25 +01:00
2018-02-28 10:17:22 +01:00
2018-02-25 11:03:51 +01:00
2018-03-11 16:19:45 +01:00
2016-09-24 10:07:35 +02:00
2017-08-06 19:19:41 -07:00
2016-06-01 12:15:53 -07:00
2018-03-11 16:19:47 +01:00
2018-03-11 16:19:44 +01:00
2017-12-16 10:33:51 +01:00
2016-10-28 03:01:35 -04:00
2018-02-25 11:03:45 +01:00
2018-01-02 20:33:20 +01:00
2017-12-25 14:22:08 +01:00
2018-01-31 12:06:09 +01:00
2018-03-03 10:19:41 +01:00
2018-03-11 16:19:46 +01:00
2017-08-06 19:19:40 -07:00
2017-08-30 10:19:29 +02:00
2017-11-30 08:37:23 +00:00
2018-02-16 20:09:47 +01:00
2017-08-06 19:19:46 -07:00
2017-07-27 15:06:09 -07:00
2018-01-02 20:33:20 +01:00
2017-06-17 06:39:37 +02:00
2018-02-28 10:17:21 +01:00
2016-04-20 15:42:09 +09:00
2016-10-07 15:23:41 +02:00
2018-01-23 19:50:16 +01:00
2018-02-25 11:03:39 +01:00
2018-02-25 11:03:51 +01:00
2016-08-16 09:30:48 +02:00
2018-02-25 11:03:50 +01:00
2016-08-10 11:49:25 +02:00
2017-03-15 09:57:14 +08:00
2017-11-02 09:40:50 +01:00
2016-08-20 18:09:20 +02:00
2018-02-22 15:44:59 +01:00
2018-03-11 16:19:47 +01:00
2018-03-03 10:19:42 +01:00
2016-03-09 15:34:49 -08:00
2016-09-24 10:07:42 +02:00
2018-03-03 10:19:42 +01:00
2017-07-27 15:06:10 -07:00
2018-02-25 11:03:44 +01:00
2018-02-25 11:03:48 +01:00
2018-02-25 11:03:46 +01:00
2018-02-25 11:03:44 +01:00
2016-06-01 12:15:53 -07:00
2018-02-25 11:03:49 +01:00
2016-10-31 04:13:59 -06:00
2018-02-28 10:17:23 +01:00
2017-10-12 11:27:35 +02:00
2017-08-06 19:19:46 -07:00
2018-02-16 20:09:38 +01:00
2018-02-25 11:03:47 +01:00
2018-02-25 11:03:42 +01:00
2017-01-19 20:17:21 +01:00
2017-03-12 06:37:29 +01:00
2018-02-16 20:09:45 +01:00
2018-03-03 10:19:45 +01:00
2018-02-25 11:03:38 +01:00