Skip to content
  • Bart Van Assche's avatar
    IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write() · 1e8bb2e9
    Bart Van Assche authored
    commit 2a78cb4d upstream.
    
    Avoid triggering an out-of-bounds stack access by changing the type
    of 'wr' from ib_send_wr into ib_rdma_wr.
    
    This patch fixes the following KASAN bug report:
    
    BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
    Read of size 8 at addr ffff880068197a48 by task kworker/2:1/44
    
    Workqueue: ib_cm cm_work_handler [ib_cm]
    Call Trace:
     dump_stack+0x8e/0xcd
     print_address_description+0x6f/0x280
     kasan_report+0x25a/0x380
     __asan_load8+0x54/0x90
     rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
     srpt_zerolength_write+0xf0/0x180 [ib_srpt]
     srpt_cm_rtu_recv+0x68/0x110 [ib_srpt]
     srpt_rdma_cm_handler+0xbb/0x15b [ib_srpt]
     cma_ib_handler+0x1aa/0x4a0 [rdma_cm]
     cm_process_work+0x30/0x100 [ib_cm]
     cm_work_handler+0xa86/0x351b [ib_cm]
     process_one_work+0x475/0x9f0
     worker_thread+0x69/0x690
     kthread+0x1ad/0x1d0
     ret_from_fork+0x3a/0x50
    
    Fixes: aaf45bd8
    
     ("IB/srpt: Detect session shutdown reliably")
    Signed-off-by: default avatarBart Van Assche <bart.vanassche@wdc.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: default avatarSudip Mukherjee <sudipm.mukherjee@gmail.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    1e8bb2e9