• Selvin Xavier's avatar
    RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message · d37b1e53
    Selvin Xavier authored
    Driver copies FW commands to the HW queue as  units of 16 bytes. Some
    of the command structures are not exact multiple of 16. So while copying
    the data from those structures, the stack out of bounds messages are
    reported by KASAN. The following error is reported.
    
    [ 1337.530155] ==================================================================
    [ 1337.530277] BUG: KASAN: stack-out-of-bounds in bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
    [ 1337.530413] Read of size 16 at addr ffff888725477a48 by task rmmod/2785
    
    [ 1337.530540] CPU: 5 PID: 2785 Comm: rmmod Tainted: G           OE     5.2.0-rc6+ #75
    [ 1337.530541] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014
    [ 1337.530542] Call Trace:
    [ 1337.530548]  dump_stack+0x5b/0x90
    [ 1337.530556]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
    [ 1337.530560]  print_address_description+0x65/0x22e
    [ 1337.530568]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
    [ 1337.530575]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
    [ 1337.530577]  __kasan_report.cold.3+0x37/0x77
    [ 1337.530581]  ? _raw_write_trylock+0x10/0xe0
    [ 1337.530588]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
    [ 1337.530590]  kasan_report+0xe/0x20
    [ 1337.530592]  memcpy+0x1f/0x50
    [ 1337.530600]  bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
    [ 1337.530608]  ? bnxt_qplib_creq_irq+0xa0/0xa0 [bnxt_re]
    [ 1337.530611]  ? xas_create+0x3aa/0x5f0
    [ 1337.530613]  ? xas_start+0x77/0x110
    [ 1337.530615]  ? xas_clear_mark+0x34/0xd0
    [ 1337.530623]  bnxt_qplib_free_mrw+0x104/0x1a0 [bnxt_re]
    [ 1337.530631]  ? bnxt_qplib_destroy_ah+0x110/0x110 [bnxt_re]
    [ 1337.530633]  ? bit_wait_io_timeout+0xc0/0xc0
    [ 1337.530641]  bnxt_re_dealloc_mw+0x2c/0x60 [bnxt_re]
    [ 1337.530648]  bnxt_re_destroy_fence_mr+0x77/0x1d0 [bnxt_re]
    [ 1337.530655]  bnxt_re_dealloc_pd+0x25/0x60 [bnxt_re]
    [ 1337.530677]  ib_dealloc_pd_user+0xbe/0xe0 [ib_core]
    [ 1337.530683]  srpt_remove_one+0x5de/0x690 [ib_srpt]
    [ 1337.530689]  ? __srpt_close_all_ch+0xc0/0xc0 [ib_srpt]
    [ 1337.530692]  ? xa_load+0x87/0xe0
    ...
    [ 1337.530840]  do_syscall_64+0x6d/0x1f0
    [ 1337.530843]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
    [ 1337.530845] RIP: 0033:0x7ff5b389035b
    [ 1337.530848] Code: 73 01 c3 48 8b 0d 2d 0b 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 0a 2c 00 f7 d8 64 89 01 48
    [ 1337.530849] RSP: 002b:00007fff83425c28 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
    [ 1337.530852] RAX: ffffffffffffffda RBX: 00005596443e6750 RCX: 00007ff5b389035b
    [ 1337.530853] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005596443e67b8
    [ 1337.530854] RBP: 0000000000000000 R08: 00007fff83424ba1 R09: 0000000000000000
    [ 1337.530856] R10: 00007ff5b3902960 R11: 0000000000000206 R12: 00007fff83425e50
    [ 1337.530857] R13: 00007fff8342673c R14: 00005596443e6260 R15: 00005596443e6750
    
    [ 1337.530885] The buggy address belongs to the page:
    [ 1337.530962] page:ffffea001c951dc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
    [ 1337.530964] flags: 0x57ffffc0000000()
    [ 1337.530967] raw: 0057ffffc0000000 0000000000000000 ffffffff1c950101 0000000000000000
    [ 1337.530970] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
    [ 1337.530970] page dumped because: kasan: bad access detected
    
    [ 1337.530996] Memory state around the buggy address:
    [ 1337.531072]  ffff888725477900: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2
    [ 1337.531180]  ffff888725477980: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
    [ 1337.531288] >ffff888725477a00: 00 f2 f2 f2 f2 f2 f2 00 00 00 f2 00 00 00 00 00
    [ 1337.531393]                                                  ^
    [ 1337.531478]  ffff888725477a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [ 1337.531585]  ffff888725477b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [ 1337.531691] ==================================================================
    
    Fix this by passing the exact size of each FW command to
    bnxt_qplib_rcfw_send_message as req->cmd_size. Before sending
    the command to HW, modify the req->cmd_size to number of 16 byte units.
    
    Fixes: 1ac5a404 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
    Signed-off-by: default avatarSelvin Xavier <selvin.xavier@broadcom.com>
    Link: https://lore.kernel.org/r/1566468170-489-1-git-send-email-selvin.xavier@broadcom.comSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
    d37b1e53
Name
Last commit
Last update
..
bnxt_re Loading commit data...
cxgb3 Loading commit data...
cxgb4 Loading commit data...
efa Loading commit data...
hfi1 Loading commit data...
hns Loading commit data...
i40iw Loading commit data...
mlx4 Loading commit data...
mlx5 Loading commit data...
mthca Loading commit data...
ocrdma Loading commit data...
qedr Loading commit data...
qib Loading commit data...
usnic Loading commit data...
vmw_pvrdma Loading commit data...
Makefile Loading commit data...