linux-stable.git/net/rds/message.c, branch linux-5.11.y

net/rds: Fix a use after free in rds_message_map_pages

2021-04-14T06:47:20+00:00

[ Upstream commit bdc2ab5c61a5c07388f4820ff21e787b4dfd1ced ]

In rds_message_map_pages, the rm is freed by rds_message_put(rm).
But rm is still used by rm->data.op_sg in return value.

My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is
freed to avoid the uaf.

Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()")
Signed-off-by: Lv Yunlong 
Reviewed-by: Håkon Bugge 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/rds: Use ERR_PTR for rds_message_alloc_sgs()

2020-04-15T19:33:29+00:00

Returning the error code via a 'int *ret' when the function returns a
pointer is very un-kernely and causes gcc 10's static analysis to choke:

net/rds/message.c: In function ‘rds_message_map_pages’:
net/rds/message.c:358:10: warning: ‘ret’ may be used uninitialized in this function [-Wmaybe-uninitialized]
  358 |   return ERR_PTR(ret);

Use a typical ERR_PTR return instead.

Signed-off-by: Jason Gunthorpe 
Acked-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

net/rds: Replace struct rds_mr's r_refcount with struct kref

2020-04-09T17:22:00+00:00

And removed rds_mr_put().

Signed-off-by: Ka-Cheong Poon 
Acked-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

rds: use DIV_ROUND_UP instead of ceil

2019-01-07T15:22:36+00:00

Yes indeed, DIV_ROUND_UP is in kernel.h.

Signed-off-by: Jacob Wen 
Signed-off-by: David S. Miller

net/rds: remove user triggered WARN_ON in rds_sendmsg

2018-12-19T18:27:58+00:00

per comment from Leon in rdma mailing list
https://lkml.org/lkml/2018/10/31/312 :

Please don't forget to remove user triggered WARN_ON.
https://lwn.net/Articles/769365/
"Greg Kroah-Hartman raised the problem of core kernel API code that will
use WARN_ON_ONCE() to complain about bad usage; that will not generate
the desired result if WARN_ON_ONCE() is configured to crash the machine.
He was told that the code should just call pr_warn() instead, and that
the called function should return an error in such situations. It was
generally agreed that any WARN_ON() or WARN_ON_ONCE() calls that can be
triggered from user space need to be fixed."

in addition harden rds_sendmsg to detect and overcome issues with
invalid sg count and fail the sendmsg.

Suggested-by: Leon Romanovsky 
Acked-by: Santosh Shilimkar 
Signed-off-by: shamir rabinovitch 
Signed-off-by: David S. Miller

rds: remove trailing whitespace and blank lines

2018-07-24T21:10:42+00:00

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

rds: remove redundant variable 'sg_off'

2018-03-12T15:12:38+00:00

Variable sg_off is assigned a value but it is never read, hence it is
redundant and can be removed.

Cleans up clang warning:
net/rds/message.c:373:2: warning: Value stored to 'sg_off' is never read

Signed-off-by: Colin Ian King 
Acked-by: Sowmini Varadhan 
Acked-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

rds: rds_info_from_znotifier() can be static

2018-03-09T02:54:00+00:00

Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification")
Signed-off-by: Fengguang Wu 
Signed-off-by: David S. Miller

rds: rds_message_zcopy_from_user() can be static

2018-03-09T02:52:20+00:00

Fixes: d40a126b16ea ("rds: refactor zcopy code into rds_message_zcopy_from_user")
Signed-off-by: Fengguang Wu 
Acked-by: Sowmini Varadhan 
Signed-off-by: David S. Miller

rds: use list structure to track information for zerocopy completion notification

2018-03-07T23:05:57+00:00

Commit 401910db4cd4 ("rds: deliver zerocopy completion notification
with data") removes support fo r zerocopy completion notification
on the sk_error_queue, thus we no longer need to track the cookie
information in sk_buff structures.

This commit removes the struct sk_buff_head rs_zcookie_queue by
a simpler list that results in a smaller memory footprint as well
as more efficient memory_allocation time.

Signed-off-by: Sowmini Varadhan 
Acked-by: Willem de Bruijn 
Signed-off-by: David S. Miller