shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-04-05 04:33:05 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
e82496fbe3a08489ffbbbcdf995be8aec575428d
linux/drivers
History
Leon Romanovsky e82496fbe3 RDMA/ucma: Don't allow join attempts for unsupported AF family 
commit 0c81ffc60d upstream.

Users can provide garbage while calling to ucma_join_ip_multicast(),
it will indirectly cause to rdma_addr_size() return 0, making the
call to ucma_process_join(), which had the right checks, but it is
better to check the input as early as possible.

The following crash from syzkaller revealed it.

kernel BUG at lib/string.c:1052!
invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4113 Comm: syz-executor0 Not tainted 4.16.0-rc5+ #261
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:fortify_panic+0x13/0x20 lib/string.c:1051
RSP: 0018:ffff8801ca81f8f0 EFLAGS: 00010286
RAX: 0000000000000022 RBX: 1ffff10039503f23 RCX: 0000000000000000
RDX: 0000000000000022 RSI: 1ffff10039503ed3 RDI: ffffed0039503f12
RBP: ffff8801ca81f8f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000000 R12: ffff8801ca81f998
R13: ffff8801ca81f938 R14: ffff8801ca81fa58 R15: 000000000000fa00
FS:  0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:000000000a12a900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000008138024 CR3: 00000001cbb58004 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 memcpy include/linux/string.h:344 [inline]
 ucma_join_ip_multicast+0x36b/0x3b0 drivers/infiniband/core/ucma.c:1421
 ucma_write+0x2d6/0x3d0 drivers/infiniband/core/ucma.c:1633
 __vfs_write+0xef/0x970 fs/read_write.c:480
 vfs_write+0x189/0x510 fs/read_write.c:544
 SYSC_write fs/read_write.c:589 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:581
 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f9ec99
RSP: 002b:00000000ff8172cc EFLAGS: 00000282 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000100
RDX: 0000000000000063 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 89 df e8 42 2c e3 fb eb de
55 48 89 fe 48 c7 c7 80 75 98 86 48 89 e5 e8 85 95 94 fb <0f> 0b 90 90 90 90
90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56
RIP: fortify_panic+0x13/0x20 lib/string.c:1051 RSP: ffff8801ca81f8f0

Fixes: 5bc2b7b397 ("RDMA/ucma: Allow user space to specify AF_IB when joining multicast")
Reported-by: <syzbot+2287ac532caa81900a4e@syzkaller.appspotmail.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:01:29 +01:00
..
accessibility
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
acpi
ACPI / bus: Parse tables as term_list for Dell XPS 9570 and Precision M5530
2018-03-08 22:41:26 -08:00
amba
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
android
binder: replace "%p" with "%pK"
2018-02-25 11:07:52 +01:00
ata
ahci: Add Intel Cannon Lake PCH-H PCI ID
2018-02-16 20:22:59 +01:00
atm
atm: horizon: Fix irq release error
2017-12-14 09:53:13 +01:00
auxdisplay
auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
2018-02-07 11:12:20 -08:00
base
dma-buf/fence: Fix lock inversion within dma-fence-array
2018-03-19 08:42:47 +01:00
bcma
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
block
loop: Fix lost writes caused by missing flag
2018-03-15 10:54:32 +01:00
bluetooth
Bluetooth: btqcomsmd: Fix skb double free corruption
2018-03-24 11:01:21 +01:00
bus
sunxi-rsb: Include OF based modalias in device uevent
2018-01-10 09:31:19 +01:00
cdrom
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
char
/dev/mem: Add bounce buffer for copy-out
2018-03-24 11:01:24 +01:00
clk
clk: migrate the count of orphaned clocks at init
2018-03-24 11:01:29 +01:00
clocksource
clocksource/drivers/stm32: Fix kernel panic with multiple timers
2018-02-16 20:23:09 +01:00
connector
…
cpufreq
cpufreq: longhaul: Revert transition_delay_us to 200 ms
2018-03-24 11:01:21 +01:00
cpuidle
cpuidle: fix broadcast control when broadcast can not be entered
2017-12-25 14:26:30 +01:00
crypto
crypto: artpec6 - set correct iv size for gcm(aes)
2018-03-24 11:01:28 +01:00
dax
dev/dax: fix uninitialized variable build warning
2017-12-20 10:10:34 +01:00
dca
…
devfreq
PM / devfreq: Propagate error from devfreq_add_device()
2018-02-22 15:42:16 +01:00
dio
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
dma
dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
2018-03-24 11:01:28 +01:00
dma-buf
dma-buf/fence: Fix lock inversion within dma-fence-array
2018-03-19 08:42:47 +01:00
edac
EDAC, sb_edac: Fix out of bound writes during DIMM configuration on KNL
2018-03-08 22:41:20 -08:00
eisa
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
extcon
extcon: int3496: process id-pin first so that we start with the right status
2018-02-28 10:19:39 +01:00
firewire
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
firmware
firmware/psci: Expose SMCCC version through psci_ops
2018-02-16 20:22:56 +01:00
fmc
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
fpga
fpga: region: release of_parse_phandle nodes after use
2018-02-07 11:12:26 -08:00
fsi
drivers/fsi/scom: Remove reset before every putscom
2017-08-28 17:15:16 +02:00
gpio
gpio: davinci: Assign first bank regs for unbanked case
2018-02-25 11:07:56 +01:00
gpu
drm/omap: DMM: Check for DMM readiness after successful transaction commit
2018-03-24 11:01:25 +01:00
hid
HID: elo: clear BTN_LEFT mapping
2018-03-19 08:42:47 +01:00
hsi
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hv
x86/virt: Add enum for hypervisors to replace x86_hyper
2017-12-25 14:26:20 +01:00
hwmon
x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
2018-02-22 15:42:24 +01:00
hwspinlock
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hwtracing
coresight: Fix disabling of CoreSight TPIU
2018-03-24 11:01:26 +01:00
i2c
i2c: bcm2835: Set up the rising/falling edge delays
2018-02-28 10:19:39 +01:00
ide
ide: ide-atapi: fix compile error with defining macro DEBUG
2017-12-17 15:08:00 +01:00
idle
Revert "x86/mm: Stop calling leave_mm() in idle code"
2017-11-04 15:01:50 +01:00
iio
iio: health: max30102: Add power enable parameter to get_temp function
2018-03-19 08:42:51 +01:00
infiniband
RDMA/ucma: Don't allow join attempts for unsupported AF family
2018-03-24 11:01:29 +01:00
input
Input: matrix_keypad - fix race when disabling interrupts
2018-03-15 10:54:32 +01:00
iommu
iommu/vt-d: clean up pr_irq if request_threaded_irq fails
2018-03-24 11:01:26 +01:00
ipack
…
irqchip
irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
2018-03-21 12:06:44 +01:00
isdn
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
leds
leds: pm8058: Silence pointer to integer size warning
2018-03-19 08:42:50 +01:00
lightnvm
lightnvm: pblk: protect line bitmap while submitting meta io
2017-12-20 10:10:38 +01:00
macintosh
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mailbox
mailbox: mailbox-test: don't rely on rx_buffer content to signal data ready
2017-12-14 09:53:12 +01:00
mcb
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
md
dm raid: fix raid set size revalidation
2018-03-19 08:42:54 +01:00
media
media: davinci: fix a debug printk
2018-03-24 11:01:26 +01:00
memory
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
memstick
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
message
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mfd
mfd: twl6040: Fix child-node lookup
2017-12-29 17:53:46 +01:00
misc
mei: me: add cannon point device ids for 4th device
2018-02-25 11:08:04 +01:00
mmc
mmc: sdhci-xenon: wait 5ms after set 1.8V signal enable
2018-03-24 11:01:25 +01:00
mtd
mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
2018-03-19 08:42:50 +01:00
mux
mux: core: fix double get_device()
2018-01-17 09:45:27 +01:00
net
sfp: fix non-detection of PHY
2018-03-24 11:01:24 +01:00
nfc
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
ntb
ntb: transport shouldn't disable link due to bogus values in SPADs
2017-08-01 13:31:44 -04:00
nubus
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
nvdimm
libnvdimm, pfn: fix start_pad handling for aligned namespaces
2017-12-29 17:53:49 +01:00
nvme
nvme-rdma: don't suppress send completions
2018-03-08 22:41:26 -08:00
nvmem
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
of
of_mdio: avoid MDIO bus removal when a PHY is missing
2018-03-03 10:24:37 +01:00
oprofile
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
parisc
parisc: Hide Diva-built-in serial aux and graphics card
2017-12-29 17:53:47 +01:00
parport
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pci
PCI: rcar: Handle rcar_pcie_parse_request_of_pci_ranges() failures
2018-03-24 11:01:26 +01:00
pcmcia
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
perf
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
phy
phy: cpcap-usb: Fix platform_get_irq_byname's error checking.
2018-03-03 10:24:22 +01:00
pinctrl
pinctrl: rockchip: enable clock when reading pin direction register
2018-03-24 11:01:26 +01:00
platform
platform/chrome: Use proper protocol transfer function
2018-03-24 11:01:23 +01:00
pnp
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
power
power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
2018-03-19 08:42:50 +01:00
powercap
…
pps
drivers/pps: use surrounding "if PPS" to remove numerous dependency checks
2017-09-08 18:26:51 -07:00
ps3
…
ptp
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pwm
pwm: stmpe: Fix wrong register offset for hwpwm=2 case
2018-03-19 08:42:51 +01:00
rapidio
drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()'
2017-12-14 09:53:08 +01:00
ras
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
regulator
regulator: stm32-vrefbuf: fix check on ready flag
2018-03-15 10:54:28 +01:00
remoteproc
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
reset
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
rpmsg
rpmsg: glink: Initialize the "intent_req_comp" completion variable
2017-12-20 10:10:29 +01:00
rtc
rtc: ac100: Fix multiple race conditions
2018-03-24 11:01:24 +01:00
s390
s390/qeth: fix IPA command submission race
2018-03-08 22:41:20 -08:00
sbus
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
scsi
scsi: mpt3sas: wait for and flush running commands on shutdown/unload
2018-03-24 11:01:28 +01:00
sfi
x86/boot: Fix memremap() related build failure
2017-07-20 11:37:58 +02:00
sh
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
sn
…
soc
soc: qcom: smsm: fix child-node lookup
2018-03-24 11:01:27 +01:00
spi
spi: sh-msiof: Avoid writing to registers from spi_master.setup()
2018-03-24 11:01:22 +01:00
spmi
spmi: pmic-arb: Move the ownership check to irq_chip callback
2017-08-28 13:52:22 +02:00
ssb
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
staging
staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
2018-03-24 11:01:21 +01:00
target
iscsi-target: make sure to wake up sleeping login worker
2018-02-22 15:42:29 +01:00
tc
…
tee
optee: fix invalid of_node_put() in optee_driver_init()
2017-12-25 14:26:24 +01:00
thermal
thermal/drivers/hisi: Fix multiple alarm interrupts firing
2017-12-25 14:26:31 +01:00
thunderbolt
thunderbolt: tb: fix use after free in tb_activate_pcie_devices
2017-12-20 10:10:24 +01:00
tty
serial: 8250_pci: Don't fail on multiport card class
2018-03-24 11:01:29 +01:00
uio
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
usb
usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
2018-03-21 12:06:45 +01:00
uwb
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
vfio
vfio: disable filesystem-dax page pinning
2018-03-08 22:41:06 -08:00
vhost
vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()
2018-02-25 11:07:45 +01:00
video
omapdrm: panel: fix compatible vendor string for td028ttec1
2018-03-24 11:01:25 +01:00
virt
virt: Convert to using %pOF instead of full_name
2017-08-29 08:52:51 -05:00
virtio
virtio_ring: fix num_free handling in error case
2018-03-15 10:54:32 +01:00
vlynq
…
vme
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
w1
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
watchdog
watchdog: Fix kref imbalance seen if handle_boot_enabled=0
2018-03-24 11:01:23 +01:00
xen
xen/gntdev: Fix partial gntdev_mmap() cleanup
2018-03-03 10:24:37 +01:00
zorro
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
Kconfig
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
Makefile
usb: build drivers/usb/common/ when USB_SUPPORT is set
2018-02-25 11:07:53 +01:00