Commit 982d78d2 authored by Chengchang Tang's avatar Chengchang Tang Committed by Zhengchao Shao
Browse files

RDMA/hns: Fix UAF for cq async event 

mainline inclusion
from mainline-v6.10-rc1
commit a942ec2745ca864cd8512142100e4027dc306a42
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S8C
CVE: CVE-2024-38545

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a942ec2745ca864cd8512142100e4027dc306a42



--------------------------------

The refcount of CQ is not protected by locks. When CQ asynchronous
events and CQ destruction are concurrent, CQ may have been released,
which will cause UAF.

Use the xa_lock() to protect the CQ refcount.

Fixes: 9a443537 ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: default avatarChengchang Tang <tangchengchang@huawei.com>
Signed-off-by: default avatarJunxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>

Conflicts:
	drivers/infiniband/hw/hns/hns_roce_cq.c
[The conflict occurs because the commit f0588567("RDMA/hns: Unified
Log Printing Style") is not merged]
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent a451086d

drivers/infiniband/hw/hns/hns_roce_cq.c

+13 −11
Original line number Diff line number Diff line
@@ -151,7 +151,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
		return ret;

	}



	ret = xa_err(xa_store(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL));

	ret = xa_err(xa_store_irq(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL));

	if (ret) {

		ibdev_err(ibdev, "failed to xa_store CQ, ret = %d.\n", ret);

		goto err_put;
@@ -164,7 +164,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
	return 0;



err_xa:

	xa_erase(&cq_table->array, hr_cq->cqn);

	xa_erase_irq(&cq_table->array, hr_cq->cqn);

err_put:

	hns_roce_table_put(hr_dev, &cq_table->table, hr_cq->cqn);
@@ -183,7 +183,7 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
		dev_err(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", ret,

			hr_cq->cqn);



	xa_erase(&cq_table->array, hr_cq->cqn);

	xa_erase_irq(&cq_table->array, hr_cq->cqn);



	/* Waiting interrupt process procedure carried out */

	synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq);
@@ -473,13 +473,6 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) 
	struct ib_event event;

	struct ib_cq *ibcq;



	hr_cq = xa_load(&hr_dev->cq_table.array,

			cqn & (hr_dev->caps.num_cqs - 1));

	if (!hr_cq) {

		dev_warn(dev, "Async event for bogus CQ 0x%06x\n", cqn);

		return;

	}



	if (event_type != HNS_ROCE_EVENT_TYPE_CQ_ID_INVALID &&

	    event_type != HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR &&

	    event_type != HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW) {
@@ -488,7 +481,16 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) 
		return;

	}



	xa_lock(&hr_dev->cq_table.array);

	hr_cq = xa_load(&hr_dev->cq_table.array,

			cqn & (hr_dev->caps.num_cqs - 1));

	if (hr_cq)

		refcount_inc(&hr_cq->refcount);

	xa_unlock(&hr_dev->cq_table.array);

	if (!hr_cq) {

		dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn);

		return;

	}



	ibcq = &hr_cq->ib_cq;

	if (ibcq->event_handler) {