Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
From:   "Saleem, Shiraz" <shiraz.saleem@intel.com>
To:     Shifeng Li <lishifeng1992@126.com>,
        "Ismail, Mustafa" <mustafa.ismail@intel.com>
CC:     "jgg@ziepe.ca" <jgg@ziepe.ca>, "leon@kernel.org" <leon@kernel.org>,
        "linux-rdma@vger.kernel.org" <linux-rdma@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "Ding, Hui" <dinghui@sangfor.com.cn>
Subject: RE: [PATCH] RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()
Thread-Topic: [PATCH] RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()
Thread-Index: AQHaGSJxg+35xx64yEWIe5/VQm5WyLB+nHiA
Date:   Fri, 17 Nov 2023 17:37:49 +0000
Message-ID: <MWHPR11MB00298470BB2C1542CE0D008AE9B7A@MWHPR11MB0029.namprd11.prod.outlook.com>
References: <20231117065043.3822-1-lishifeng1992@126.com>
In-Reply-To: <20231117065043.3822-1-lishifeng1992@126.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?w5CpDy4/ffxElzx399k4dEcl+TMZEtepfl7Cd5WeSLmJNEWpUU0ecRMrl5rd?=
 =?us-ascii?Q?S4496AtHQDhuukCm4Ya7wvVDpFggs6NIZfeuyb9NBTLa4eUPF52/1WiBOhRS?=
 =?us-ascii?Q?X238BOcGwHpsGbwMecfIswnuSHACWZDGI6uwYHt3LL8ZC87EQ6QX0o2K6CSe?=
 =?us-ascii?Q?JfwkuS3MQX2osQLSPDyqGSlqQbVL8rHe1jRlXOzyaE0iKJnSfO6MgrLzOoAb?=
 =?us-ascii?Q?MqXP03MG4ZUfbKVmvYQZQLAq85efmO8t9hhm4jILpXzlkXwSBlRQMi8jR6gA?=
 =?us-ascii?Q?f66eoIMoWuguHPTMudtVUjt90DlEuhGFmlPHoSuE5Yu2Ue4XIurvw3Nte7/r?=
 =?us-ascii?Q?zLYUWoLBc2qRAUJ3HkQ6b2kuvoABnY+VKp9mqaof3u1t0yO4hvnv7VOfpZxn?=
 =?us-ascii?Q?J8z6WQoTipgKUZT0kqSCBumNb8xSOe6ZX9crWVRbtmxA1B6txxSZH4Bm9RXk?=
 =?us-ascii?Q?tEnOoj9uFKdh3rwm57pkRG+tq324BTwxYp0glpeptjc1JJGFDB40EZxm4jNk?=
 =?us-ascii?Q?yn8vvYyQIu5anyojmsrC4qkBDgGYvAmK/8/vykN+DSq/XCYQks/bc2P4Hx4H?=
 =?us-ascii?Q?WAAERD/FuC1tiq1jfI1lVImqGKsJFxtmDOkg/VcFjxH7cygfJymmEMBgIN19?=
 =?us-ascii?Q?zBA09L48RxD+633Q7rm5/Dp5ffO323u7pk3YcjqqsXcjthO5Zi2wTRTNzxa9?=
 =?us-ascii?Q?U8MgF4riKU2irk/nu94Jm6iziQkcLBwVSnkd0takltYbtn5XxAl88tGNMiJh?=
 =?us-ascii?Q?szlebbFNzstPWa4WH33kkQSf+8l1jyI0CYvseN/VbFn9U7ZJAKmkVL9lb/Z0?=
 =?us-ascii?Q?etcXobv7yxa4HixVOjYKdSX2lUyxuXeKfrrITmy3IXLprjfYlrpvvoxOgfY7?=
 =?us-ascii?Q?VKZDWBTdnkIAoVCYrcKVyd60eIJ0GZygpAeP5PlGWXNfpbw+7KUeywMcWiCP?=
 =?us-ascii?Q?/p6j6/UTVn9Mx22BO0jTms/L0XhNqLqyDY8exBR8BWR7Xg0zYEiEqRdxdFar?=
 =?us-ascii?Q?ytc8w2i5s2/6C/VgjaDxHUy2GcMxaSwJaLWqwFXJJoKa6fRmNk1pgE1JKF7e?=
 =?us-ascii?Q?J1jaKWmaRhqG/tvzT+hrugpW4QpXDg/5OnWlg8wizHjAsvYhSjOX0ikZTwqG?=
 =?us-ascii?Q?6D888vgy81mScnOOFRsgJNjwH5W0wOIc0R8SoSvoR2JUPsUIOFLsZ5zBdV1C?=
 =?us-ascii?Q?pYSIUY3OY/JdXvY29morDRAJa/jUJCp/DiS/OeDgIMDB5DvQeQORpzHNDhi2?=
 =?us-ascii?Q?8UQ+3tRK2mZW93nWdpAxspwHKaOExuDqagEuDb+oFXZxoBPIU2lSO61Iak7J?=
 =?us-ascii?Q?CHBUVIapYWeUeZp1tAwUzuSxLwj7/ysYjtCPm9qmcxyU3jINeSyhdqeeSaBt?=
 =?us-ascii?Q?uJOglc8r299zMvPHrX84cU0Of38FEiIqcc9xItPQPfwcPiZdwvS7KlUUVji9?=
 =?us-ascii?Q?zgcfaOTCNcDHGdkJI8zW+Rrkv5zANvEN2Bo9voNgv8q4ApYsTTiJFIgWCAzI?=
 =?us-ascii?Q?SzKwmms//JSJQYBkBSMmVl5VE9OUkwx2uneam5YLbtiQBqDf+Ym1ZzChkmhX?=
 =?us-ascii?Q?dz6Ov4Sus4rXRw5rHUYYKjLx+uwRo7CKsUH98FHI?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MWHPR11MB0029.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 84ce9881-0d62-45b2-d367-08dbe793eb57
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Nov 2023 17:37:49.7052
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: SBKTXFfiPNvnpQqD9S3bQaKvEhf4REO4HfWKyXG0gKcki3Mpv3RzkZ3L/PO7UUKxnFSXLZABDDO4ungEToiBNg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB8345
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE
	autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Fri, 17 Nov 2023 09:38:10 -0800 (PST)

> Subject: [PATCH] RDMA/irdma: Fix UAF in irdma_sc_ccq_get_cqe_info()
>=20
> When removing the irdma driver or unplugging its aux device, the ccq queu=
e is
> released before destorying the cqp_cmpl_wq queue.
> But in the window, there may still be completion events for wqes. That wi=
ll cause a
> UAF in irdma_sc_ccq_get_cqe_info().
>=20
> [34693.333191] BUG: KASAN: use-after-free in
> irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333194] Read of size=
 8
> at addr ffff889097f80818 by task kworker/u67:1/26327 [34693.333194]
> [34693.333199] CPU: 9 PID: 26327 Comm: kworker/u67:1 Kdump: loaded
> Tainted: G           O     --------- -t - 4.18.0 #1
> [34693.333200] Hardware name: SANGFOR Inspur/NULL, BIOS 4.1.13
> 08/01/2016 [34693.333211] Workqueue: cqp_cmpl_wq cqp_compl_worker
> [irdma] [34693.333213] Call Trace:
> [34693.333220]  dump_stack+0x71/0xab
> [34693.333226]  print_address_description+0x6b/0x290
> [34693.333238]  ? irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma]
> [34693.333240]  kasan_report+0x14a/0x2b0 [34693.333251]
> irdma_sc_ccq_get_cqe_info+0x82f/0x8c0 [irdma] [34693.333264]  ?
> irdma_free_cqp_request+0x151/0x1e0 [irdma] [34693.333274]
> irdma_cqp_ce_handler+0x1fb/0x3b0 [irdma] [34693.333285]  ?
> irdma_ctrl_init_hw+0x2c20/0x2c20 [irdma] [34693.333290]  ?
> __schedule+0x836/0x1570 [34693.333293]  ? strscpy+0x83/0x180
> [34693.333296]  process_one_work+0x56a/0x11f0 [34693.333298]
> worker_thread+0x8f/0xf40 [34693.333301]  ? __kthread_parkme+0x78/0xf0
> [34693.333303]  ? rescuer_thread+0xc50/0xc50 [34693.333305]
> kthread+0x2a0/0x390 [34693.333308]  ? kthread_destroy_worker+0x90/0x90
> [34693.333310]  ret_from_fork+0x1f/0x40
>=20
> Signed-off-by: Shifeng Li <lishifeng1992@126.com>
> ---
>  drivers/infiniband/hw/irdma/hw.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>=20
> diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/ird=
ma/hw.c
> index ab246447520b..de7337a6a874 100644
> --- a/drivers/infiniband/hw/irdma/hw.c
> +++ b/drivers/infiniband/hw/irdma/hw.c
> @@ -570,8 +570,6 @@ static void irdma_destroy_cqp(struct irdma_pci_f *rf,
> bool free_hwcqp)
>  	struct irdma_cqp *cqp =3D &rf->cqp;
>  	int status =3D 0;
>=20
> -	if (rf->cqp_cmpl_wq)
> -		destroy_workqueue(rf->cqp_cmpl_wq);
>  	if (free_hwcqp)
>  		status =3D irdma_sc_cqp_destroy(dev->cqp);
>  	if (status)
> @@ -737,6 +735,8 @@ static void irdma_destroy_ccq(struct irdma_pci_f *rf)
>  	struct irdma_ccq *ccq =3D &rf->ccq;
>  	int status =3D 0;
>=20
> +	if (rf->cqp_cmpl_wq)
> +		destroy_workqueue(rf->cqp_cmpl_wq);
>  	if (!rf->reset)
>  		status =3D irdma_sc_ccq_destroy(dev->ccq, 0, true);
>  	if (status)
> --
> 2.25.1

Looks good. Thanks!

Acked-by: Shiraz Saleem <shiraz.saleem@intel.com>