redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/net/rds
History
shamir rabinovitch ea010070d0 net/rds: fix warn in rds_message_alloc_sgs 
redundant copy_from_user in rds_sendmsg system call expose rds
to issue where rds_rdma_extra_size walk the rds iovec and and
calculate the number pf pages (sgs) it need to add to the tail of
rds message and later rds_cmsg_rdma_args copy the rds iovec again
and re calculate the same number and get different result causing
WARN_ON in rds_message_alloc_sgs.

fix this by doing the copy_from_user only once per rds_sendmsg
system call.

When issue occur the below dump is seen:

WARNING: CPU: 0 PID: 19789 at net/rds/message.c:316 rds_message_alloc_sgs+0x10c/0x160 net/rds/message.c:316
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 19789 Comm: syz-executor827 Not tainted 4.19.0-next-20181030+ #101
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 panic+0x2ad/0x55c kernel/panic.c:188
 __warn.cold.8+0x20/0x45 kernel/panic.c:540
 report_bug+0x254/0x2d0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:969
RIP: 0010:rds_message_alloc_sgs+0x10c/0x160 net/rds/message.c:316
Code: c0 74 04 3c 03 7e 6c 44 01 ab 78 01 00 00 e8 2b 9e 35 fa 4c 89 e0 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 14 9e 35 fa <0f> 0b 31 ff 44 89 ee e8 18 9f 35 fa 45 85 ed 75 1b e8 fe 9d 35 fa
RSP: 0018:ffff8801c51b7460 EFLAGS: 00010293
RAX: ffff8801bc412080 RBX: ffff8801d7bf4040 RCX: ffffffff8749c9e6
RDX: 0000000000000000 RSI: ffffffff8749ca5c RDI: 0000000000000004
RBP: ffff8801c51b7490 R08: ffff8801bc412080 R09: ffffed003b5c5b67
R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000
R13: 000000000007165c R14: 000000000007165c R15: 0000000000000005
 rds_cmsg_rdma_args+0x82d/0x1510 net/rds/rdma.c:623
 rds_cmsg_send net/rds/send.c:971 [inline]
 rds_sendmsg+0x19a2/0x3180 net/rds/send.c:1273
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:632
 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2117
 __sys_sendmsg+0x11d/0x280 net/socket.c:2155
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2162
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x44a859
Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b cb fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1d4710ada8 EFLAGS: 00000297 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044a859
RDX: 0000000000000000 RSI: 0000000020001600 RDI: 0000000000000003
RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000297 R12: 00000000006dcc2c
R13: 646e732f7665642f R14: 00007f1d4710b9c0 R15: 00000000006dcd2c
Kernel Offset: disabled
Rebooting in 86400 seconds..

Reported-by: syzbot+26de17458aeda9d305d8@syzkaller.appspotmail.com
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: shamir rabinovitch <shamir.rabinovitch@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2018-12-19 10:27:58 -08:00
..
Kconfig net/rds: RDS is not Radio Data System 2018-08-31 23:09:53 -07:00
Makefile rds: remove trailing whitespace and blank lines 2018-07-24 14:10:42 -07:00
af_rds.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
bind.c rds: fix two RCU related problems 2018-09-12 00:09:19 -07:00
cong.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
connection.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
ib.c net/rds: Use rdma_read_gids to get connection SGID/DGID in IPv6 2018-08-27 15:26:01 -07:00
ib.h rds: Fix build regression. 2018-09-23 12:25:15 -07:00
ib_cm.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
ib_fmr.c net/rds/ib_fmr.c: use kmalloc_array_node() 2017-11-15 18:21:02 -08:00
ib_frmr.c Merge branch 'linus/master' into rdma.git for-next 2018-08-16 14:21:29 -06:00
ib_mr.h Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
ib_rdma.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
ib_recv.c Merge branch 'linus/master' into rdma.git for-next 2018-08-16 14:21:29 -06:00
ib_ring.c RDS/IW+IB: Set recv ring low water mark to 1/2 full. 2009-04-09 17:21:14 -07:00
ib_send.c Merge branch 'linus/master' into rdma.git for-next 2018-08-16 14:21:29 -06:00
ib_stats.c RDS: IB: add few useful cache stasts 2017-01-02 14:02:51 -08:00
ib_sysctl.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
info.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
info.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
loop.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
loop.h rds: clean up loopback rds_connections on netns deletion 2018-06-27 10:11:03 +09:00
message.c rds: remove trailing whitespace and blank lines 2018-07-24 14:10:42 -07:00
page.c rds: remove dead code 2016-12-26 21:35:39 -05:00
rdma.c net/rds: fix warn in rds_message_alloc_sgs 2018-12-19 10:27:58 -08:00
rdma_transport.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
rdma_transport.h rds: Enable RDS IPv6 support 2018-07-23 21:17:44 -07:00
rds.h net/rds: fix warn in rds_message_alloc_sgs 2018-12-19 10:27:58 -08:00
rds_single_path.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
recv.c net: rds: use memset to optimize the recv 2018-09-17 08:19:51 -07:00
send.c net/rds: fix warn in rds_message_alloc_sgs 2018-12-19 10:27:58 -08:00
stats.c net/rds: zero last byte for strncpy 2013-03-08 00:35:44 -05:00
sysctl.c net: rds: fix coding style issues 2016-06-18 21:34:09 -07:00
tcp.c rds: tcp: remove duplicated include from tcp.c 2018-08-21 09:50:53 -07:00
tcp.h rds: Enable RDS IPv6 support 2018-07-23 21:17:44 -07:00
tcp_connect.c rds: Enable RDS IPv6 support 2018-07-23 21:17:44 -07:00
tcp_listen.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
tcp_recv.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
tcp_send.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
tcp_stats.c net: rds: fix const array syntax 2011-07-01 16:16:19 -07:00
threads.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
transport.c rds: remove trailing whitespace and blank lines 2018-07-24 14:10:42 -07:00