From 367a52ce054c9cdc5bd389349c42000c7c2f0d56 Mon Sep 17 00:00:00 2001 From: Andreas Wellving Date: Fri, 12 Oct 2018 07:40:38 +0200 Subject: infiniband: CVE-2018-14734 infiniband: fix a possible use-after-free bug References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb2595c1393b4a5211534e6f0a0fbad369e21ad8 Change-Id: I7a0963bbef9aa85f2e4b040c5e4ef2735cae1be7 Signed-off-by: Andreas Wellving --- patches/cve/4.9.x.scc | 2 + ...iniband-fix-a-possible-use-after-free-bug.patch | 58 ++++++++++++++++++++++ 2 files changed, 60 insertions(+) create mode 100644 patches/cve/4.9.x.scc create mode 100644 patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc new file mode 100644 index 0000000..fb8cc06 --- /dev/null +++ b/patches/cve/4.9.x.scc @@ -0,0 +1,2 @@ +#CVEs fixed in 4.9.117: +patch CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch diff --git a/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch b/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch new file mode 100644 index 0000000..4756a18 --- /dev/null +++ b/patches/cve/CVE-2018-14734-infiniband-fix-a-possible-use-after-free-bug.patch @@ -0,0 +1,58 @@ +From cb2595c1393b4a5211534e6f0a0fbad369e21ad8 Mon Sep 17 00:00:00 2001 +From: Cong Wang +Date: Fri, 1 Jun 2018 11:31:44 -0700 +Subject: [PATCH] infiniband: fix a possible use-after-free bug + +ucma_process_join() will free the new allocated "mc" struct, +if there is any error after that, especially the copy_to_user(). + +But in parallel, ucma_leave_multicast() could find this "mc" +through idr_find() before ucma_process_join() frees it, since it +is already published. + +So "mc" could be used in ucma_leave_multicast() after it is been +allocated and freed in ucma_process_join(), since we don't refcnt +it. + +Fix this by separating "publish" from ID allocation, so that we +can get an ID first and publish it later after copy_to_user(). + +CVE: CVE-2018-14734 +Upstream-Status: Backport + +Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support") +Reported-by: Noam Rathaus +Signed-off-by: Cong Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Andreas Wellving +--- + drivers/infiniband/core/ucma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index eab43b1..ec8fb28 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) + return NULL; + + mutex_lock(&mut); +- mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); ++ mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); + mutex_unlock(&mut); + if (mc->id < 0) + goto error; +@@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct ucma_file *file, + goto err3; + } + ++ mutex_lock(&mut); ++ idr_replace(&multicast_idr, mc, mc->id); ++ mutex_unlock(&mut); ++ + mutex_unlock(&file->mut); + ucma_put_ctx(ctx); + return 0; +-- +2.7.4 + -- cgit v1.2.3-54-g00ecf