Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp847277pja; Wed, 1 Apr 2020 09:46:12 -0700 (PDT) X-Google-Smtp-Source: APiQypJYc6RYgFnYphvchTZphjvARW5ztiMr97sztRaIW2pSF5I1mkrUamMS0eGQk28e+o+2GNFU X-Received: by 2002:aca:cf48:: with SMTP id f69mr3196808oig.122.1585759572705; Wed, 01 Apr 2020 09:46:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759572; cv=none; d=google.com; s=arc-20160816; b=Y5zClraiwLQmWekxyRCVghKD1He89AfSilbPjU6pAQmdxlxzWSEDilRB4uQvA+1cp9 PLW1/PfgpVx9iNhT2fnBIx+dZ9VePaaW1lg/djuu0JarIPuBQt/mPzxGREyrYIRNwAk2 5cOW34+21uYoGwoAHu7t/MvJACtPqd34dhYJ/EmSOYbxCkGQWjBkyvJoCOGOrexZUxLu HmqRlmd0aRKQKn/XK9QkaZ8LtzjrcxIygNN82+9a6pHJjfWcGkwXLpGFHgP4YkNe8AKj ieoizyz2j8v/s6dnccjKgkbgSPPhfHmb2yvgCkn3lNdadtUXgECaloo7nEWnN0vFGiYO RVag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=r+opKMOk/VjC+zwKeWOJyLv2TcCW9ScTua1/bd1gAh0=; b=JzV7rcq0UpY/TiwkwbHQL/TFTCW0RjbTmFJBqi5PJLyOdgU9Tvt5gi4BgtlNPCXjNv ZhQBNEN52ao3SUTQ4pfIQLjPHZmisZEHbM+uOSQaSd/gfTp20wbY7NSwRICKb/DfSsgd Q27XKocYBjbnvzSDQtEGYkMEWB3QBv4yn3G/eKf2K36fM/l7OW7/6xp8DIjHopP8iLKw nI2iIwk6EaI9bnpGOtrOJUd2UEmKcQgYl1WgXSc7N/ArlhZ2MOCoUWijZZHl7d1atXfu 09TV83/sgJSrpcmKRK2sg1bde7/Q/y8VzAW7I6Zl+4ph9ttRLUxd+WEwlxF6MZoW+F5W ux5Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=GGVTG1IN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f6si981990oom.58.2020.04.01.09.45.59; Wed, 01 Apr 2020 09:46:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=GGVTG1IN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389819AbgDAQpI (ORCPT + 99 others); Wed, 1 Apr 2020 12:45:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:46332 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389815AbgDAQpH (ORCPT ); Wed, 1 Apr 2020 12:45:07 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 283FE2063A; Wed, 1 Apr 2020 16:45:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759506; bh=O+nBFrE5K3SaGgqqy3tb0bn4XRb2uUJTw85fqQhg8VI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GGVTG1INBJw/CbzYxthi7Vun++J4uDxGE1uTtB1qNfX6EF9TqYmViWPZmjm1RMCLw I8uUKpEGVDF7i7dmhwGOHElJgP7Zr7eLpWi5F6s3W/zKm2pyFJmumRefJ9fj4K54kw wG7YSdx/k0aOGWPmOg0DYKReA842/1CncayWtoiY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kaike Wan , Mike Marciniszyn , Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 4.14 101/148] RDMA/core: Ensure security pkey modify is not lost Date: Wed, 1 Apr 2020 18:18:13 +0200 Message-Id: <20200401161602.477152561@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mike Marciniszyn commit 2d47fbacf2725a67869f4d3634c2415e7dfab2f4 upstream. The following modify sequence (loosely based on ipoib) will lose a pkey modifcation: - Modify (pkey index, port) - Modify (new pkey index, NO port) After the first modify, the qp_pps list will have saved the pkey and the unit on the main list. During the second modify, get_new_pps() will fetch the port from qp_pps and read the new pkey index from qp_attr->pkey_index. The state will still be zero, or IB_PORT_PKEY_NOT_VALID. Because of the invalid state, the new values will never replace the one in the qp pps list, losing the new pkey. This happens because the following if statements will never correct the state because the first term will be false. If the code had been executed, it would incorrectly overwrite valid values. if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) new_pps->main.state = IB_PORT_PKEY_VALID; if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) { new_pps->main.port_num = qp_pps->main.port_num; new_pps->main.pkey_index = qp_pps->main.pkey_index; if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) new_pps->main.state = IB_PORT_PKEY_VALID; } Fix by joining the two if statements with an or test to see if qp_pps is non-NULL and in the correct state. Fixes: 1dd017882e01 ("RDMA/core: Fix protection fault in get_pkey_idx_qp_list") Link: https://lore.kernel.org/r/20200313124704.14982.55907.stgit@awfm-01.aw.intel.com Reviewed-by: Kaike Wan Signed-off-by: Mike Marciniszyn Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/core/security.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) --- a/drivers/infiniband/core/security.c +++ b/drivers/infiniband/core/security.c @@ -348,16 +348,11 @@ static struct ib_ports_pkeys *get_new_pp else if (qp_pps) new_pps->main.pkey_index = qp_pps->main.pkey_index; - if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) + if (((qp_attr_mask & IB_QP_PKEY_INDEX) && + (qp_attr_mask & IB_QP_PORT)) || + (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)) new_pps->main.state = IB_PORT_PKEY_VALID; - if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) { - new_pps->main.port_num = qp_pps->main.port_num; - new_pps->main.pkey_index = qp_pps->main.pkey_index; - if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) - new_pps->main.state = IB_PORT_PKEY_VALID; - } - if (qp_attr_mask & IB_QP_ALT_PATH) { new_pps->alt.port_num = qp_attr->alt_port_num; new_pps->alt.pkey_index = qp_attr->alt_pkey_index;