From nobody Mon Jun 13 15:06:36 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 1CD2B844D0A; Mon, 13 Jun 2022 15:06:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LMFJr7109z4Wnc; Mon, 13 Jun 2022 15:06:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655132797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JhUg4l2zJwmxp19ddGADm1pYVV1sAWzPBCFQq+UHoGU=; b=VfSnuw+CoX1tP7TLka65ScX3HNDQaG2qQ0vRcYWOWQKC2mjez6EuN6WwPmrmWFyZRcs5B8 KKvMVdfjSYla9xXj74L8X1GevpbHYymc5jkPZAGHn9MnZFgRxQyj6/dSjvAdUoL36VAr6e F41CvpwXGEqwM46bztQc8mzmXMpdmv46HAjmohqv/PWjOk8Rl7VEZ0hnj05WdftEKlBGKt TUpUIZFhFnBLr0hsYTG3ZVCpBBP68EMcLGr0T9OUuRyT2SQD49f8ynGLirJBKLVIWwnmHW Vk3v3r97F+EA9bEOnMgJv+t9gs7oDbOSf1gsVIvpPvBdGaXXvCxryNw+VqfH2Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B59FC17F9C; Mon, 13 Jun 2022 15:06:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 25DF6aFb059089; Mon, 13 Jun 2022 15:06:36 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 25DF6aNA059088; Mon, 13 Jun 2022 15:06:36 GMT (envelope-from git) Date: Mon, 13 Jun 2022 15:06:36 GMT Message-Id: <202206131506.25DF6aNA059088@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Hans Petter Selasky Subject: git: 66a0bc2105e4 - main - ibcore: Fix use-after-free access in ucma_close() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: hselasky X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 66a0bc2105e43e54abfaa9f48b76c28371fa2d62 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655132797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JhUg4l2zJwmxp19ddGADm1pYVV1sAWzPBCFQq+UHoGU=; b=f8PWIg2SYaQnQ0WJct2GRUkJeg7kWFcxN5bFPYQOp03HrJSbUM2MHfRVw8oYCgb+XeVm7x 5LWn+F0s+Sd3bwrEY5cxbdi+QXUwyF2YtN8Z5XFdk+jlCNp1TZSjGoAQZOYu/eU2WAKtBE phrc5THgVGXvk58QLkszAsfK3C+vCng3ywPzyE7v8IYdQ4Pm2vYW9JxQpdOYIOZNO+4Vtl Tw4Tbu9lUGppMyfMNb5R/488TuuOyCvzimMCGvX29fQS99tdyHc7ib51eY0NRUBNtkz0zN 4zoFDBtfjB++HqDAXME17Gn83FBw/H5YiUjFWB9QZOHDt9SLcVPDoreTBUEvqw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1655132797; a=rsa-sha256; cv=none; b=tN3+zGNHwYdFhDFofEUfI5WhIn2jXqmGMRB4Q12vjMfNRLSSuuzBlkz5vzZX84VmxiInXt Y5Ux0LxwMyH3NNiSlcj4xJpm3kqQscxtQGQyHwYrR5iyIuH4gCJ5BtzhbryJggkuxLWI1u wy2aeEmMoGqoFNWFiEHM0v1z/HBC4+AudWEMyKCFbKeWLQqowxckmB3d7Ptp8IXvyauACa XsRDxlghdwVdWdmDwWW3yy3ghX7M2egccmuTEYbqYTihoyQ46SOvjcbLUKDFySLmCUHkR0 KP6nsFCAuDzLJxAi3JOIYcf48eJ4Gu7WqM1kcPxdCmOLmZipzTT+sFQA4QHdTg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by hselasky: URL: https://cgit.FreeBSD.org/src/commit/?id=66a0bc2105e43e54abfaa9f48b76c28371fa2d62 commit 66a0bc2105e43e54abfaa9f48b76c28371fa2d62 Author: Hans Petter Selasky AuthorDate: 2022-06-13 14:55:14 +0000 Commit: Hans Petter Selasky CommitDate: 2022-06-13 15:00:16 +0000 ibcore: Fix use-after-free access in ucma_close() The error in ucma_create_id() left ctx in the list of contexts belong to ucma file descriptor. The attempt to close this file descriptor causes to use-after-free accesses while iterating over such list. Linux commit: ed65a4dc22083e73bac599ded6a262318cad7baf PR: 264650 MFC after: 1 week Sponsored by: NVIDIA Networking --- sys/ofed/drivers/infiniband/core/ib_ucma.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/ofed/drivers/infiniband/core/ib_ucma.c b/sys/ofed/drivers/infiniband/core/ib_ucma.c index 878e4d348234..0082c60f0b6c 100644 --- a/sys/ofed/drivers/infiniband/core/ib_ucma.c +++ b/sys/ofed/drivers/infiniband/core/ib_ucma.c @@ -508,6 +508,9 @@ err1: mutex_lock(&mut); idr_remove(&ctx_idr, ctx->id); mutex_unlock(&mut); + mutex_lock(&file->mut); + list_del(&ctx->list); + mutex_unlock(&file->mut); kfree(ctx); return ret; }