В ядре Linux устранена следующая уязвимость:
RDMA/rxe: исправлено OOB в free_rd_atomic_resources().
free_rd_atomic_resources() выполняет итерацию, используя qp->attr.max_dest_rd_atomic.
Обновление max_dest_rd_atomic перед освобождением старого массива может привести к
свободный путь проходит мимо старого распределения и вызывает выход плиты за пределы поля
напишите пойманное КАСАНОМ:
==============================================================
ОШИБКА: KASAN: плита выходит за пределы в драйверах free_rd_atomic_resource/infiniband/sw/rxe/rxe_qp.c:180 [inline]
ОШИБКА: KASAN: плита выходит за пределы в драйверах free_rd_atomic_resources/infiniband/sw/rxe/rxe_qp.c:171 [inline]
ОШИБКА: KASAN: плита выходит за пределы в драйверах free_rd_atomic_resources/infiniband/sw/rxe/rxe_qp.c:163 [inline]
ОШИБКА: KASAN: выход плиты за пределы границ в rxe_qp_from_attr+0x1e88/0x2150 driver/infiniband/sw/rxe/rxe_qp.c:712
Запись размера 4 по адресу ffff88802b8dddb8 с помощью задачи syz.3.451/11063.
ЦП: 0 UID: 0 PID: 11063 Связь: syz.3.451 Не испорчен 7.1.0 #2 PREEMPT(полный)
Имя оборудования: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, исправление Arch_caps, 1996), BIOS 1.16.3-debian-1.16.3-2 01.04.2014
Отслеживание вызова:
<ЗАДАЧА>
__dump_stack lib/dump_stack.c:94 [встроенный]
dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [встроенный]
print_report+0xf7/0x600 мм/kasan/report.c:482
kasan_report+0xe4/0x120 мм/kasan/report.c:595
free_rd_atomic_resource driver/infiniband/sw/rxe/rxe_qp.c:180 [встроенный]
драйверы free_rd_atomic_resources/infiniband/sw/rxe/rxe_qp.c:171 [встроенный]
драйверы free_rd_atomic_resources/infiniband/sw/rxe/rxe_qp.c:163 [встроенный]
rxe_qp_from_attr+0x1e88/0x2150 драйверы/infiniband/sw/rxe/rxe_qp.c:712
rxe_modify_qp+0x1e2/0x530 драйверы/infiniband/sw/rxe/rxe_verbs.c:623
ib_security_modify_qp+0x223/0xfa0 драйверы/infiniband/core/security.c:625
_ib_modify_qp+0x333/0xec0 драйверы/infiniband/core/verbs.c:1915
Modify_qp+0x13ca/0x1940 драйверы/infiniband/core/uverbs_cmd.c:1932
ib_uverbs_modify_qp+0xcb/0x120 драйверы/infiniband/core/uverbs_cmd.c:1958
ib_uverbs_write+0xb86/0x1030 драйверы/infiniband/core/uverbs_main.c:680
vfs_write+0x2aa/0x1070 fs/read_write.c:686
ksys_write+0x1f8/0x250 фс/read_write.c:740
do_syscall_x64 Arch/x86/entry/syscall_64.c:63 [встроенный]
do_syscall_64+0x116/0x800 Arch/x86/entry/syscall_64.c:94
запись_SYSCALL_64_after_hwframe+0x77/0x7f
РИП: 0033:0x7fefc75a70cd
Код: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b: 00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd
RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007
RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0
</TASK>
Выделено заданием 11063:
kasan_save_stack+0x33/0x60 мм/kasan/common.c:57
kasan_save_track+0x14/0x30 мм/kasan/common.c:78
яд_kmalloc_redzone мм/kasan/common.c:398 [встроенный]
__kasan_kmalloc+0xaa/0xb0 мм/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [встроенный]
__do_kmalloc_node мм/slub.c:5296 [встроенный]
__kmalloc_noprof+0x32a/0x850 мм/slub.c:5308
kmalloc_noprof include/linux/slab.h:954 [встроенный]
kzalloc_noprof include/linux/slab.h:1188 [встроенный]
alloc_rd_atomic_resources driver/infiniband/sw/rxe/rxe_qp.c:155 [встроенный]
rxe_qp_from_attr+0x3f8/0x2150 драйверы/infiniband/sw/rxe/rxe_qp.c:714
rxe_modify_qp+0x1e2/0x530 драйверы/infiniband/sw/rxe/rxe_verbs.c:623
ib_security_modify_qp+0x223/0xfa0 драйверы/infiniband/core/security.c:625
_ib_modify_qp+0x333/0xec0 драйверы/infiniband/core/verbs.c:1915
Modify_qp+0x13ca/0x1940 драйверы/infiniband/core/uverbs_cmd.c:1932
ib_uverbs_modify_qp+0xcb/0x120 драйверы/infiniband/core/uverbs_cmd.c:1958
ib_uverbs_write+0xb86/0x1030 драйверы/infiniband/core/uverbs_ma
---усечено---
Показать оригинальное описание (EN)
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the free path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN: ================================================================== BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063 CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xf7/0x600 mm/kasan/report.c:482 kasan_report+0xe4/0x120 mm/kasan/report.c:595 free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007 RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0 </TASK> Allocated by task 11063: kasan_save_stack+0x33/0x60 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5296 [inline] __kmalloc_noprof+0x32a/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline] rxe_qp_from_attr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:714 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_ma ---truncated---