Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <eaddbca3-fb83-4f0e-501e-fed2d7e292b4@nvidia.com>
Date:   Fri, 28 Jul 2023 09:40:03 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: use-after-free in debug_spin_lock_before invoked the rdma driver
Content-Language: en-US
To:     Zheng Zhang <zheng.zhang@email.ucr.edu>, jgg@ziepe.ca,
        leon@kernel.org, mbloch@nvidia.com
References: <CAC_GQSqAC56qOvJFYu02fmWaRRsZ-Q-e6Z0xD+j8iFU9GxCNXA@mail.gmail.com>
Cc:     linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
From:   Mark Zhang <markzhang@nvidia.com>
In-Reply-To: <CAC_GQSqAC56qOvJFYu02fmWaRRsZ-Q-e6Z0xD+j8iFU9GxCNXA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TGo2b0JvVFlybjJUUTlITkZsMWJiYnhhazBKQkNhZXJzQmJCdmhMQ3VMVnpv?=
 =?utf-8?B?ektjeEhtTXAxaUtCZEJMdmNYdVl4Z05UY0N1QTRYQitQYllscWQvQ2M5eDF2?=
 =?utf-8?B?WG1CM0x3SFMvZTVtVEZaSE93VDNxdTRXeGpEbGFLUzI4NFVDajJ3bkpySy9D?=
 =?utf-8?B?dDRNZTNQOWZuTU9UeTVoQWRWWmlPcTdFWm9oSVQ4SEtudHFSSXI1LzFOLytj?=
 =?utf-8?B?Wnk5R2Q4Tk1JeHo0bkRNdmRzRkltY291a3p2VmwrQWVuQ3dnZGdDL0RWeVdv?=
 =?utf-8?B?SXBxWGdUWXBsczAycjhwUWZHc3hPOEF0Q0VJQlpYMmpZK3RoRkhwWVBOYTdR?=
 =?utf-8?B?VDhHVlo1MGlOV2kzL1ZlRDVncGc4VUpYLzYwK0RCaHVPeWNPV0J2R3NnbG5B?=
 =?utf-8?B?QVdqbUI2Tk95NVJaQWpCMEptSkdpRmJVQUFzZnJSbU10dTgxRTgyMWdrV1c3?=
 =?utf-8?B?REY0Ymw4UGJNM0dQb0dUTzFVQ3kveU05dmdoYm5OTFFOWVMxQzZuOUNPMlYw?=
 =?utf-8?B?Q2FSSzl4RmU5UHpLUkJxa0VOTGg5b3AwZjhaNXozTXRHVlRJWVFucUF0SCtw?=
 =?utf-8?B?NHZGamNYSHh5RTdYQ0E2U1FNZUxQajZHY1RVajZWR05HaG05NFJnNGtxSmZj?=
 =?utf-8?B?RlM2cUF1a3AxZWpjSWtRcTkxaEN3ZEV2ell2OC9lRGVFRjFoT09vZnUzYXFa?=
 =?utf-8?B?bGVnSUdLRTFTaXZBZmNYVjdpN3VFZmM3N2NiSDYvN2hvTGEvV3Q1NW5ZcDAz?=
 =?utf-8?B?YjdkZmZSVjAxY3JvcFIzS0svM0JCeU95dTZ4aXpLT0JKOUp2M2J5Mko0b2dw?=
 =?utf-8?B?OUpCblR4bmJPeVNoK0tEUWxoYXg0eU9IZm5NOFdtWkFrSTdNdnM1ZWNZNGlz?=
 =?utf-8?B?Z3BWRytnYTlFTERIenRvOVN1YzQzbXZ2bVE2bmZXaFB6b1YrYVNPTDc3Q1I4?=
 =?utf-8?B?QnU0TVVVMWRYcHl3aEE1OTdYT3FQcmVkVnUwbUloL0N3Q2ZJTnd5QU1sNkZz?=
 =?utf-8?B?REV4QVRocWRGUWxKd2xPUW4xTTJXOVBCdDVtbFZpemlnQi9RSFdDa3dLOVhl?=
 =?utf-8?B?VktZK1RYWFFNb01kb0NTbWNzZFo5aERHY1E4U0pKSG83U1M5OVducG9HNDBS?=
 =?utf-8?B?QWUzVXhEOGYzb1VDbWJiSjdWNisyT0piNnM4VEhsT1BzQ1FtNE0zR1dwbktH?=
 =?utf-8?B?QnZmY3NSaDhBTkFVdXBlMCtjNE1TVEt4bFVicDdqL2Q1WS9TbFE5anUvdXls?=
 =?utf-8?B?dTUweWloZXRFMlZpUU5WQ0tKZlhDRWREVUFoUFFjYWdleG95VzRhWVNwUG1X?=
 =?utf-8?B?RjM4ZEswMVVZMGpnYU9HRC96VWtEWlRDN1VxVHBHUjlyMWtjTkhoUGg2YWdv?=
 =?utf-8?B?a0ovQUVMSkRMbUlFZCtUN3l3Uzd4RVc4QjZWZmZCUEcyR3h6Y01lNCtHQktk?=
 =?utf-8?B?aHBQV0poaFpReGtzSXJiSXpId3V3MWs4Z1hWWjBnSFJYOHFQYTdWZzRlUkxi?=
 =?utf-8?B?Qk9ITE9nRFNKa1VIeTFIRWMyWnRaSmsxdGJ3bmNLREFFTnE3VHh5UnZ2MEFa?=
 =?utf-8?B?QmFoM2tvQmJ1R1JxamQwY1RsTUtrSXI0cUFrZHZWUmNWQTZ2UjRVREZKb01F?=
 =?utf-8?B?Y3czUHBoWm5JK1A1aUFwM1pXWjRFdTAxME83Sm5NQnJ5azIzUXpaeksvVXdZ?=
 =?utf-8?B?KzRJTjducXFxdTNpZlI2bFpXdmtDdUsxWnU1cTNqb3pUTXplMnRnM1VES241?=
 =?utf-8?B?Z1dDTGdqekxVanZCQ3paZ0tpdE5ZZUhMMjZwVFhCaFRxTHpBcDFxK05IRkdo?=
 =?utf-8?B?ZzRSSGdGMVdXenBKV0lsZDd2endCck9sTTZhQjNHbStTZGpJS2dzSmdXdEM3?=
 =?utf-8?B?SXN0WDdqbDVrb2tnejFUREFxN0RBUzdaWS92eG9haGNyaWJSTUZmcUV2enJH?=
 =?utf-8?B?QzdnUU1aL1lZc2hTUGQ5NTVUeWM3c1hRVkZLZ2tMT0xaeTJjby9YWkR5N1FC?=
 =?utf-8?B?UUVDNjZ2TzZ5Y0Vaa2Y4LzlzaW5oOVdHOVA4cmUzYzk4YWxUMmdXam1KTmNs?=
 =?utf-8?B?cGpENWlrVng2YTlQVnhTUGZqaGNlNGxrVkJlc0RhTkRFajF6Ly9VOEFlZ1hF?=
 =?utf-8?Q?IK9x8Pd9aoNP59WxuzQCV8l9O?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b7366032-f0d5-4de9-aad8-08db8f0b9751
X-MS-Exchange-CrossTenant-AuthSource: IA1PR12MB7495.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jul 2023 01:40:15.2833
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: KrjmcCJT4qdn/bhYz8eRTdvl64aVKVqy99N8usiKFwfmaPypSpSUe5oyHiUHnHln4SkxgxClwGupb91qPig20w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR12MB6699
X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        NICE_REPLY_A,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,
        SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=no
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 7/28/2023 8:45 AM, Zheng Zhang wrote:
> *External email: Use caution opening links or attachments*
> 
> 
> Jason, Leon, Mark Zhang, Mark Bloch and  to whom it may concern:
> 
> Hello! We have found a bug in the Linux kernel version 6.2.0 by 
> Syzkaller with our own templates. In the call trace it invoked the rdma 
> driver, thus we think it may be different from the reported case invoked 
> io_ring whose fix is also in the io_ring module.
> Unfortunately, it doesn't generate a reproducer.
> 
> Attached is the report, log generated by syzkaller.
> Please let me know if there is any additional information that I can 
> provide to help debug this issue.
> Thanks!
> Best
> zheng
> 
Hi Zheng,

Thank you very much for reporting. Is it easy to reproduce? Can you 
please help test with this patch, thanks:

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 1ee87c3aaeab..76810aac1809 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3491,11 +3491,13 @@ static void addr_handler(int status, struct 
sockaddr *src_addr,
  		event.event = RDMA_CM_EVENT_ADDR_RESOLVED;

  	if (cma_cm_event_handler(id_priv, &event)) {
+		cma_id_put(id_priv);
  		destroy_id_handler_unlock(id_priv);
  		return;
  	}
  out:
  	mutex_unlock(&id_priv->handler_mutex);
+	cma_id_put(id_priv);
  }

  static int cma_resolve_loopback(struct rdma_id_private *id_priv)
@@ -4107,6 +4109,9 @@ int rdma_resolve_addr(struct rdma_cm_id *id, 
struct sockaddr *src_addr,
  				rdma_addr_cancel(&id->route.addr.dev_addr);
  			else
  				id_priv->used_resolve_ip = 1;
+
+			/* Balances with cma_id_put() in addr_handler */
+			cma_id_get(id_priv);
  			ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr,
  					      &id->route.addr.dev_addr,
  					      timeout_ms, addr_handler,