Patch has been sent out
https://lists.ubuntu.com/archives/kernel-team/2019-December/106510.html
** Changed in: linux (Ubuntu Eoan)
Status: Incomplete => In Progress
** Changed in: linux (Ubuntu Eoan)
Assignee: (unassigned) => Ike Panhc (ikepanhc)
** Changed in: linux (Ubuntu Disco)
Status: Incomplete => In Progress
** Changed in: linux (Ubuntu Disco)
Assignee: (unassigned) => Ike Panhc (ikepanhc)
** Changed in: linux (Ubuntu Bionic)
Status: Incomplete => In Progress
** Changed in: linux (Ubuntu Bionic)
Assignee: (unassigned) => Ike Panhc (ikepanhc)
** Changed in: linux (Ubuntu)
Status: Incomplete => Invalid
** Changed in: kunpeng920
Status: New => In Progress
** Changed in: kunpeng920
Assignee: (unassigned) => Ike Panhc (ikepanhc)
** Description changed:
- "[Bug Description]
+ [Impact]
+ KASAN reports slab-out-of-bounds in RDMA/hns driver
+
+ [Testcase]
+ Enable KASAN and modprobe RDMA/hns driver
+
+ [Regression Risk]
+ Only RDMA/hns driver modified. lowest risk to other drivers/platforms
+
+ [Bug Description]
KASAN: slab-out-of-bounds in hns_roce_table_mhop_put+0x584/0x828
- [hns_roce]
- Read of size 8 at addr ffff802185e08300 by task rmmod/270
-
- Call trace:
- dump_backtrace+0x0/0x1e8
- show_stack+0x14/0x20
- dump_stack+0xc4/0xfc
- print_address_description+0x60/0x270
- __kasan_report+0x164/0x1b8
- kasan_report+0xc/0x18
- __asan_load8+0x84/0xa8
- hns_roce_table_mhop_put+0x584/0x828 [hns_roce]
- hns_roce_table_put+0x174/0x1a0 [hns_roce]
- hns_roce_mr_free+0x124/0x210 [hns_roce]
- hns_roce_dereg_mr+0x90/0xb8 [hns_roce]
- ib_dealloc_pd_user+0x60/0xf0
- ib_mad_port_close+0x128/0x1d8
- ib_mad_remove_device+0x94/0x118
- remove_client_context+0xa0/0xe0
- disable_device+0xfc/0x1c0
- __ib_unregister_device+0x60/0xe0
- ib_unregister_device+0x24/0x38
- hns_roce_exit+0x3c/0x138 [hns_roce]
- __hns_roce_hw_v2_uninit_instance.isra.30+0x28/0x50 [hns_roce_hw_v2]
- hns_roce_hw_v2_uninit_instance+0x44/0x60 [hns_roce_hw_v2]
- hclge_uninit_client_instance+0x15c/0x238 [hclge]
- hnae3_uninit_client_instance+0x84/0xa8 [hnae3]
- hnae3_unregister_client+0x84/0x158 [hnae3]
- hns_roce_hw_v2_exit+0x14/0x20 [hns_roce_hw_v2]
- __arm64_sys_delete_module+0x20c/0x308
- el0_svc_handler+0xbc/0x210
- el0_svc+0x8/0xc
-
- Allocated by task 255:
- __kasan_kmalloc.isra.0+0xd0/0x180
- kasan_kmalloc+0xc/0x18
- __kmalloc+0x16c/0x328
- hns_roce_init_hem_table+0x20c/0x428 [hns_roce]
- hns_roce_init+0x214/0xfe0 [hns_roce]
- __hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
- hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
- hclge_init_roce_client_instance+0x180/0x310 [hclge]
- hclge_init_client_instance+0xcc/0x508 [hclge]
- hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
- hnae3_register_client+0x134/0x1a8 [hnae3]
- 0xffff200009c00014
- do_one_initcall+0x9c/0x3e0
- do_init_module+0xd4/0x2d8
- load_module+0x3284/0x3690
- __se_sys_init_module+0x274/0x308
- __arm64_sys_init_module+0x40/0x50
- el0_svc_handler+0xbc/0x210
- el0_svc+0x8/0xc
-
- Freed by task 0:
- (stack is not available)
-
- The buggy address belongs to the object at ffff802185e06300
- which belongs to the cache kmalloc-8k of size 8192
- The buggy address is located 0 bytes to the right of
- 8192-byte region [ffff802185e06300, ffff802185e08300)
- The buggy address belongs to the page:
- page:ffff7fe008617800 refcount:1 mapcount:0 mapping:ffff802340020e00
index:0x0
- compound_mapcount: 0
- flags: 0x5fffe00000010200(slab|head)
- raw: 5fffe00000010200 dead000000000100 dead000000000200 ffff802340020e00
- raw: 0000000000000000 00000000803e003e 00000001ffffffff 0000000000000000
- page dumped because: kasan: bad access detected
- Memory state around the buggy address:
- ffff802185e08200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- ffff802185e08280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- >ffff802185e08300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
- ^
- ffff802185e08380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
- ffff802185e08400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- ==================================================================
- Disabling lock debugging due to kernel taint
+ [hns_roce]
+ Read of size 8 at addr ffff802185e08300 by task rmmod/270
+ Call trace:
+ dump_backtrace+0x0/0x1e8
+ show_stack+0x14/0x20
+ dump_stack+0xc4/0xfc
+ print_address_description+0x60/0x270
+ __kasan_report+0x164/0x1b8
+ kasan_report+0xc/0x18
+ __asan_load8+0x84/0xa8
+ hns_roce_table_mhop_put+0x584/0x828 [hns_roce]
+ hns_roce_table_put+0x174/0x1a0 [hns_roce]
+ hns_roce_mr_free+0x124/0x210 [hns_roce]
+ hns_roce_dereg_mr+0x90/0xb8 [hns_roce]
+ ib_dealloc_pd_user+0x60/0xf0
+ ib_mad_port_close+0x128/0x1d8
+ ib_mad_remove_device+0x94/0x118
+ remove_client_context+0xa0/0xe0
+ disable_device+0xfc/0x1c0
+ __ib_unregister_device+0x60/0xe0
+ ib_unregister_device+0x24/0x38
+ hns_roce_exit+0x3c/0x138 [hns_roce]
+ __hns_roce_hw_v2_uninit_instance.isra.30+0x28/0x50 [hns_roce_hw_v2]
+ hns_roce_hw_v2_uninit_instance+0x44/0x60 [hns_roce_hw_v2]
+ hclge_uninit_client_instance+0x15c/0x238 [hclge]
+ hnae3_uninit_client_instance+0x84/0xa8 [hnae3]
+ hnae3_unregister_client+0x84/0x158 [hnae3]
+ hns_roce_hw_v2_exit+0x14/0x20 [hns_roce_hw_v2]
+ __arm64_sys_delete_module+0x20c/0x308
+ el0_svc_handler+0xbc/0x210
+ el0_svc+0x8/0xc
+
+ Allocated by task 255:
+ __kasan_kmalloc.isra.0+0xd0/0x180
+ kasan_kmalloc+0xc/0x18
+ __kmalloc+0x16c/0x328
+ hns_roce_init_hem_table+0x20c/0x428 [hns_roce]
+ hns_roce_init+0x214/0xfe0 [hns_roce]
+ __hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
+ hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
+ hclge_init_roce_client_instance+0x180/0x310 [hclge]
+ hclge_init_client_instance+0xcc/0x508 [hclge]
+ hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
+ hnae3_register_client+0x134/0x1a8 [hnae3]
+ 0xffff200009c00014
+ do_one_initcall+0x9c/0x3e0
+ do_init_module+0xd4/0x2d8
+ load_module+0x3284/0x3690
+ __se_sys_init_module+0x274/0x308
+ __arm64_sys_init_module+0x40/0x50
+ el0_svc_handler+0xbc/0x210
+ el0_svc+0x8/0xc
+
+ Freed by task 0:
+ (stack is not available)
+
+ The buggy address belongs to the object at ffff802185e06300
+ which belongs to the cache kmalloc-8k of size 8192
+ The buggy address is located 0 bytes to the right of
+ 8192-byte region [ffff802185e06300, ffff802185e08300)
+ The buggy address belongs to the page:
+ page:ffff7fe008617800 refcount:1 mapcount:0 mapping:ffff802340020e00
index:0x0
+ compound_mapcount: 0
+ flags: 0x5fffe00000010200(slab|head)
+ raw: 5fffe00000010200 dead000000000100 dead000000000200 ffff802340020e00
+ raw: 0000000000000000 00000000803e003e 00000001ffffffff 0000000000000000
+ page dumped because: kasan: bad access detected
+ Memory state around the buggy address:
+ ffff802185e08200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ffff802185e08280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ >ffff802185e08300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ^
+ ffff802185e08380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff802185e08400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ==================================================================
+ Disabling lock debugging due to kernel taint
[Steps to Reproduce]
Enable KASAN and configure PAGE_SIZE to 64K, insmod hns roce driver and then
rmmod it.
[Actual Results]
Call trace because of slab-out-of-bound.
[Expected Results]
Success
[Reproducibility]
Inevitably
[Additional information]
Hardware: D06 CS
Firmware: NA
Kernel: NA
[Resolution]
- Not configure eq->next when number of eq_buf is 1 in eq_mhop_alloc()."
+ Not configure eq->next when number of eq_buf is 1 in eq_mhop_alloc().
- RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver
+ RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver
RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1853989
Title:
[roce-1126]RDMA/hns: bugfix for slab-out-of-bounds when loading hip08
driver
To manage notifications about this bug go to:
https://bugs.launchpad.net/kunpeng920/+bug/1853989/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
