Skip to contentSkip to conversation

IB/core: Fix potential NULL pointer dereference in pkey cache

PATCH Applied Leon Romanovsky 2 participants 2 messages May 7, 2020 – May 8, 2020 InfiniBand

lore
Share & tools
lore

Leon Romanovsky

author
#0 lore raw

PATCH v2 1/1 IB/core: Fix potential NULL pointer dereference in pkey cache

From: Jack Morgenstein <[email protected]>

The IB core pkey cache is populated by procedure ib_cache_update(). Initially, the pkey cache pointer is NULL. ib_cache_update allocates a buffer and populates it with the device's pkeys, via repeated calls to procedure ib_query_pkey().

If there is a failure in populating the pkey buffer via ib_query_pkey(), ib_cache_update does not replace the old pkey buffer cache with the updated one -- it leaves the old cache as is.

Since initially the pkey buffer cache is NULL, when calling ib_cache_update the first time, a failure in ib_query_pkey() will cause the pkey buffer cache pointer to remain NULL.

In this situation, any calls subsequent to ib_get_cached_pkey(), ib_find_cached_pkey(), or ib_find_cached_pkey_exact() will try to dereference the NULL pkey cache pointer, causing a kernel panic.

Fix this by checking the ib_cache_update() return value.

Fixes 8faea9fd4a39 ("RDMA/cache: Move the cache per-port data into the main ib_port_data")
Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by Jack Morgenstein <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>

---
Changelog:
v2: Removed error unwinding
v1: https://lore.kernel.org/linux-rdma/[email protected]
I rewrote the patch to take care of ib_cache_update() return value.
v0: https://lore.kernel.org/linux-rdma/[email protected]

---
 drivers/infiniband/core/cache.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/infiniband/core/cache.c +5 -2
index 717b798cddad..a670209bbce6 100644
@@ -1553,8 +1553,11 @@ int ib_cache_setup_one(struct ib_device *device)
 	if (err)
 		return err;
 
-	rdma_for_each_port (device, p)
-		ib_cache_update(device, p, true);
+	rdma_for_each_port (device, p) {
+		err = ib_cache_update(device, p, true);
+		if (err)
+			return err;
+	}
 
 	return 0;
 }

--
2.26.2

Applied
#1 lore raw
Quoted 31 lines · Leon Romanovsky

From: Jack Morgenstein <[email protected]>

The IB core pkey cache is populated by procedure ib_cache_update(). Initially, the pkey cache pointer is NULL. ib_cache_update allocates a buffer and populates it with the device's pkeys, via repeated calls to procedure ib_query_pkey().

If there is a failure in populating the pkey buffer via ib_query_pkey(), ib_cache_update does not replace the old pkey buffer cache with the updated one -- it leaves the old cache as is.

Since initially the pkey buffer cache is NULL, when calling ib_cache_update the first time, a failure in ib_query_pkey() will cause the pkey buffer cache pointer to remain NULL.

In this situation, any calls subsequent to ib_get_cached_pkey(), ib_find_cached_pkey(), or ib_find_cached_pkey_exact() will try to dereference the NULL pkey cache pointer, causing a kernel panic.

Fix this by checking the ib_cache_update() return value.

Fixes 8faea9fd4a39 ("RDMA/cache: Move the cache per-port data into the main ib_port_data")
Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by Jack Morgenstein <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>

---
Changelog:
v2: Removed error unwinding
v1: https://lore.kernel.org/linux-rdma/[email protected]
I rewrote the patch to take care of ib_cache_update() return value.
v0: https://lore.kernel.org/linux-rdma/[email protected]

Quoted 3 lines
---
 drivers/infiniband/core/cache.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Applied to for-rc

Thanks,
Jason