No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Shay Drory 2a4c0bf5c7 IB/mad: Fix use after free when destroying MAD agent
commit 116a1b9f1cb769b83e5adff323f977a62b1dcb2e upstream.

Currently, when RMPP MADs are processed while the MAD agent is destroyed,
it could result in use after free of rmpp_recv, as decribed below:

	cpu-0						cpu-1
	-----						-----
ib_mad_recv_done()
 ib_mad_complete_recv()
  ib_process_rmpp_recv_wc()
						unregister_mad_agent()
						 ib_cancel_rmpp_recvs()
						  cancel_delayed_work()
   process_rmpp_data()
    start_rmpp()
     queue_delayed_work(rmpp_recv->cleanup_work)
						  destroy_rmpp_recv()
						   free_rmpp_recv()
     cleanup_work()[1]
      spin_lock_irqsave(&rmpp_recv->agent->lock) <-- use after free

[1] cleanup_work() == recv_cleanup_handler

Fix it by waiting for the MAD agent reference count becoming zero before
calling to ib_cancel_rmpp_recvs().

Fixes: 9a41e38a46 ("IB/mad: Use IDR for agent IDs")
Link: https://lore.kernel.org/r/20200621104738.54850-2-leon@kernel.org
Signed-off-by: Shay Drory <shayd@mellanox.com>
Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-30 15:36:52 -04:00
arch fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" 2020-06-30 15:36:47 -04:00
block block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed 2020-06-30 15:36:43 -04:00
certs
crypto crypto: algboss - don't wait during notifier callback 2020-06-24 17:50:51 +02:00
Documentation dt-bindings: display: mediatek: control dpi pins mode to avoid leakage 2020-06-22 09:30:58 +02:00
drivers IB/mad: Fix use after free when destroying MAD agent 2020-06-30 15:36:52 -04:00
fs cifs/smb3: Fix data inconsistent when zero file range 2020-06-30 15:36:51 -04:00
include sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket 2020-06-30 15:36:45 -04:00
init x86: Fix early boot crash on gcc-10, third try 2020-05-20 08:20:34 +02:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:20:16 +02:00
kernel kretprobe: Prevent triggering kretprobe from within kprobe_flush_task 2020-06-24 17:50:52 +02:00
lib lib/zlib: remove outdated and incorrect pre-increment optimization 2020-06-24 17:50:39 +02:00
LICENSES
mm mm: call cond_resched() from deferred_init_memmap() 2020-06-22 09:31:14 +02:00
net net: sched: export __netdev_watchdog_up() 2020-06-30 15:36:47 -04:00
samples samples: bpf: Fix build error 2020-06-03 08:21:15 +02:00
scripts scripts: headers_install: Exit with error on config leak 2020-06-24 17:50:33 +02:00
security selinux: fix double free 2020-06-24 17:50:48 +02:00
sound ALSA: usb-audio: Fix OOB access of mixer element list 2020-06-30 15:36:50 -04:00
tools perf stat: Fix NULL pointer dereference 2020-06-24 17:50:45 +02:00
usr
virt KVM: arm64: Save the host's PtrAuth keys in non-preemptible context 2020-06-17 16:40:38 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.49 2020-06-24 17:50:53 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.