RDS: Fix rds-ping inducing kernel panic
Subsystems (4)
PATCH 1/1 RDS: Fix rds-ping inducing kernel panic
As described in: https://bugzilla.redhat.com/show_bug.cgi?id=822754
Attempting an RDS connection from the IP address of an IPoIB interface to itself causes a kernel panic due to a BUG_ON() being triggered. Making the test less strict allows rds-ping to work without crashing the machine.
A local unprivileged user could use this flaw to crash the sytem.
I think this fix was written by Jay Fenlason <[email protected]>, and extracted from the RedHat kernel patches here:
This fix appears to have been carried by at least RedHat, Oracle, and Ubuntu for several years.
CVE-2012-2372
---
This is what I get for researching CVE lifetimes...
--- net/rds/ib_send.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/ib_send.c +1 -1
@@ -506,7 +506,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,int flow_controlled =0 ;int nr_sig =0 ; -BUG_ON (off %RDS_FRAG_SIZE ); +BUG_ON (!conn->c_loopback && off %RDS_FRAG_SIZE );BUG_ON (hdr_off !=0 && hdr_off !=sizeof (struct rds_header ));/* Do not send cong updates to IB loopback */
Signature · 6 lines
2.7.4 -- Kees Cook Pixel Security
Quoted 8 lines · Kees Cook
As described in: https://bugzilla.redhat.com/show_bug.cgi?id=822754
Attempting an RDS connection from the IP address of an IPoIB interface to itself causes a kernel panic due to a
BUG_ON()being triggered. Making the test less strict allows rds-ping to work without crashing the machine.A local unprivileged user could use this flaw to crash the sytem.
s/sytem/system
Quoted 25 lines
I think this fix was written by Jay Fenlason <[email protected]>, and extracted from the RedHat kernel patches here:
This fix appears to have been carried by at least RedHat, Oracle, and Ubuntu for several years.
CVE-2012-2372
Reported-by Honggang Li <[email protected]>Signed-off-by Kees Cook <[email protected]>---
This is what I get for researching CVE lifetimes...--- net/rds/ib_send.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)net/rds/ib_send.c +0
-0
net/rds/ib_send.c int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm, · line 510
Quoted 6 lines
net/rds/ib_send.c +1
-1@@ -506,7 +506,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,int flow_controlled =0 ;int nr_sig =0 ; -BUG_ON (off %RDS_FRAG_SIZE ); +BUG_ON (!conn->c_loopback && off %RDS_FRAG_SIZE );BUG_ON (hdr_off !=0 && hdr_off !=sizeof (struct rds_header ));
To be honest this function full of BUG_ONs and it looks fishy to have them there. Why don't we return EINVAL instead of crashing system?
Thanks
Quoted 9 lines
net/rds/ib_send.c +0
-1/* Do not send cong updates to IB loopback */ --2.7.4
--
Kees Cook
Pixel Security
David Miller
maintainerFrom: Leon Romanovsky <[email protected]>
Date: Mon, 22 Jan 2018 17:10:54 +0200
Quoted 9 lines · Kees Cook
Quoted 8 lines
net/rds/ib_send.c +0
-0@@ -506,7 +506,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,int flow_controlled =0 ;int nr_sig =0 ;
Quoted 6 lines
net/rds/ib_send.c int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm, · line 510
Quoted 3 lines
net/rds/ib_send.c +1
-1-BUG_ON (off %RDS_FRAG_SIZE ); +BUG_ON (!conn->c_loopback && off %RDS_FRAG_SIZE );BUG_ON (hdr_off !=0 && hdr_off !=sizeof (struct rds_header ));To be honest this function full of
BUG_ONsand it looks fishy to have them there. Why don't we return EINVAL instead of crashing system?
I completely agree that these assertions should just cause an error-out rather than trigger a BUG().
Quoted 19 lines · David Miller
From: Leon Romanovsky <[email protected]>
Date: Mon, 22 Jan 2018 17:10:54 +0200Quoted 9 lines · Kees Cook
Quoted 8 lines
net/rds/ib_send.c +0
-0@@ -506,7 +506,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,int flow_controlled =0 ;int nr_sig =0 ;Quoted 6 lines
net/rds/ib_send.c int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm, · line 510
Quoted 3 lines
net/rds/ib_send.c +1
-1-BUG_ON (off %RDS_FRAG_SIZE ); +BUG_ON (!conn->c_loopback && off %RDS_FRAG_SIZE );BUG_ON (hdr_off !=0 && hdr_off !=sizeof (struct rds_header ));To be honest this function full of
BUG_ONsand it looks fishy to have them there. Why don't we return EINVAL instead of crashing system?
Quoted 2 lines
I completely agree that these assertions should just cause an error-out rather than trigger a
BUG().
Andy did remove bunch of them but there are still few more left overs. Will have a look at remainder set since most of them were added during early development and remained there. Thanks Dave/Leon.
Regards,
Santosh
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 9 lines · Kees Cook
As described in: https://bugzilla.redhat.com/show_bug.cgi?id=822754
Attempting an RDS connection from the IP address of an IPoIB interface to itself causes a kernel panic due to a
BUG_ON()being triggered. Making the test less strict allows rds-ping to work without crashing the machine.A local unprivileged user could use this flaw to crash the sytem.
Are you able to reproduce this issue on mainline kernel ? IIRC, this sjouldn't happen anymore but if you see it, please let me know. Will try it as well. rds-ping on self loopback device is often tested and used as well for monitoring services in production.
Quoted 5 lines
I think this fix was written by Jay Fenlason <[email protected]>, and extracted from the RedHat kernel patches here:
It was part of redhat patched kernel but not carried in shipping Oracle UEK kernels at least afaik.
Quoted 10 lines
This fix appears to have been carried by at least RedHat, Oracle, and Ubuntu for several years.
CVE-2012-2372
Reported-by Honggang Li <[email protected]>Signed-off-by Kees Cook <[email protected]>---
This is what I get for researching CVE lifetimes...
Am not sure if its applicable anymore. Infact the issue with loopback device was due to congestion update and thats been already addressed with commit '18fc25c94: {rds: prevent BUG_ON triggered on congestion update to loopback}'
Regards,
Santosh
Quoted 9 lines · Santosh Shilimkar
Quoted 8 lines · Kees Cook
As described in: https://bugzilla.redhat.com/show_bug.cgi?id=822754
Attempting an RDS connection from the IP address of an IPoIB interface to itself causes a kernel panic due to a
BUG_ON()being triggered. Making the test less strict allows rds-ping to work without crashing the machine.
Quoted 7 lines
Quoted 2 lines
A local unprivileged user could use this flaw to crash the sytem.
Are you able to reproduce this issue on mainline kernel ? IIRC, this sjouldn't happen anymore but if you see it, please let me know. Will try it as well. rds-ping on self loopback device is often tested and used as well for monitoring services in production.
I don't have an RDS test setup, no. But it sounds like kernels without this patch aren't seeing the problem.
Quoted 4 lines
Am not sure if its applicable anymore. Infact the issue with loopback device was due to congestion update and thats been already addressed with commit '
18fc25c94: {rds: preventBUG_ONtriggered on congestion update to loopback}'
That looks very much like it was fixed there. Thanks!
-Kees
Signature · 2 lines
Kees Cook Pixel Security
Quoted 13 lines · Kees Cook
Quoted 11 lines · Santosh Shilimkar
Quoted 10 lines · Kees Cook
As described in: https://bugzilla.redhat.com/show_bug.cgi?id=822754
Attempting an RDS connection from the IP address of an IPoIB interface to itself causes a kernel panic due to a
BUG_ON()being triggered. Making the test less strict allows rds-ping to work without crashing the machine.A local unprivileged user could use this flaw to crash the sytem.
Quoted 9 lines
Quoted 5 lines
Are you able to reproduce this issue on mainline kernel ? IIRC, this sjouldn't happen anymore but if you see it, please let me know. Will try it as well. rds-ping on self loopback device is often tested and used as well for monitoring services in production.
I don't have an RDS test setup, no. But it sounds like kernels without this patch aren't seeing the problem.
Yep. Thats what I thought and hence asked.
Quoted 7 lines
Quoted 4 lines
Am not sure if its applicable anymore. Infact the issue with loopback device was due to congestion update and thats been already addressed with commit '
18fc25c94: {rds: preventBUG_ONtriggered on congestion update to loopback}'That looks very much like it was fixed there. Thanks!
Yeah. Thanks Kees !!
Regards,
Santosh
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html