Commit 0d3d08fe authored by Karsten Graul's avatar Karsten Graul Committed by Litao Jiao
Browse files

net/smc: fix access to parent of an ib device 

mainline inclusion
from mainline-v5.11-rc1
commit 995433b7
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I78IFM
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=995433b795cec0a4ef6c8603e7642903c621943a



--------------------------------

The parent of an ib device is used to retrieve the PCI device
attributes. It turns out that there are possible cases when an ib device
has no parent set in the device structure, which may lead to page
faults when trying to access this memory.
Fix that by checking the parent pointer and consolidate the pci device
specific processing in a new function.

Fixes: a3db10ef ("net/smc: Add support for obtaining SMCR device list")
Reported-by: default avatar <syzbot+600fef7c414ee7e2d71b@syzkaller.appspotmail.com>
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Link: https://lore.kernel.org/r/20201215091058.49354-2-kgraul@linux.ibm.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarYingyu Zeng <zengyingyu@sangfor.com.cn>
parent 867e8aa4

net/smc/smc_ib.c

+23 −13
Original line number Diff line number Diff line
@@ -394,6 +394,22 @@ static int smc_nl_handle_dev_port(struct sk_buff *skb, 
	return -EMSGSIZE;

}



static bool smc_nl_handle_pci_values(const struct smc_pci_dev *smc_pci_dev,

				     struct sk_buff *skb)

{

	if (nla_put_u32(skb, SMC_NLA_DEV_PCI_FID, smc_pci_dev->pci_fid))

		return false;

	if (nla_put_u16(skb, SMC_NLA_DEV_PCI_CHID, smc_pci_dev->pci_pchid))

		return false;

	if (nla_put_u16(skb, SMC_NLA_DEV_PCI_VENDOR, smc_pci_dev->pci_vendor))

		return false;

	if (nla_put_u16(skb, SMC_NLA_DEV_PCI_DEVICE, smc_pci_dev->pci_device))

		return false;

	if (nla_put_string(skb, SMC_NLA_DEV_PCI_ID, smc_pci_dev->pci_id))

		return false;

	return true;

}



static int smc_nl_handle_smcr_dev(struct smc_ib_device *smcibdev,

				  struct sk_buff *skb,

				  struct netlink_callback *cb)
@@ -417,19 +433,13 @@ static int smc_nl_handle_smcr_dev(struct smc_ib_device *smcibdev, 
	is_crit = smcr_diag_is_dev_critical(&smc_lgr_list, smcibdev);

	if (nla_put_u8(skb, SMC_NLA_DEV_IS_CRIT, is_crit))

		goto errattr;

	if (smcibdev->ibdev->dev.parent) {

		memset(&smc_pci_dev, 0, sizeof(smc_pci_dev));

		pci_dev = to_pci_dev(smcibdev->ibdev->dev.parent);

		smc_set_pci_values(pci_dev, &smc_pci_dev);

	if (nla_put_u32(skb, SMC_NLA_DEV_PCI_FID, smc_pci_dev.pci_fid))

		goto errattr;

	if (nla_put_u16(skb, SMC_NLA_DEV_PCI_CHID, smc_pci_dev.pci_pchid))

		goto errattr;

	if (nla_put_u16(skb, SMC_NLA_DEV_PCI_VENDOR, smc_pci_dev.pci_vendor))

		goto errattr;

	if (nla_put_u16(skb, SMC_NLA_DEV_PCI_DEVICE, smc_pci_dev.pci_device))

		goto errattr;

	if (nla_put_string(skb, SMC_NLA_DEV_PCI_ID, smc_pci_dev.pci_id))

		if (!smc_nl_handle_pci_values(&smc_pci_dev, skb))

			goto errattr;

	}

	snprintf(smc_ibname, sizeof(smc_ibname), "%s", smcibdev->ibdev->name);

	if (nla_put_string(skb, SMC_NLA_DEV_IB_NAME, smc_ibname))

		goto errattr;