Revision 4b658d1bbc16605330694bb3ef2570c465ef383d authored by Leon Romanovsky on 25 March 2018, 08:23:55 UTC, committed by Jason Gunthorpe on 27 March 2018, 20:10:45 UTC
Add missing check that device is connected prior to access it.

[   55.358652] BUG: KASAN: null-ptr-deref in rdma_init_qp_attr+0x4a/0x2c0
[   55.359389] Read of size 8 at addr 00000000000000b0 by task qp/618
[   55.360255]
[   55.360432] CPU: 1 PID: 618 Comm: qp Not tainted 4.16.0-rc1-00071-gcaf61b1b8b88 #91
[   55.361693] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014
[   55.363264] Call Trace:
[   55.363833]  dump_stack+0x5c/0x77
[   55.364215]  kasan_report+0x163/0x380
[   55.364610]  ? rdma_init_qp_attr+0x4a/0x2c0
[   55.365238]  rdma_init_qp_attr+0x4a/0x2c0
[   55.366410]  ucma_init_qp_attr+0x111/0x200
[   55.366846]  ? ucma_notify+0xf0/0xf0
[   55.367405]  ? _get_random_bytes+0xea/0x1b0
[   55.367846]  ? urandom_read+0x2f0/0x2f0
[   55.368436]  ? kmem_cache_alloc_trace+0xd2/0x1e0
[   55.369104]  ? refcount_inc_not_zero+0x9/0x60
[   55.369583]  ? refcount_inc+0x5/0x30
[   55.370155]  ? rdma_create_id+0x215/0x240
[   55.370937]  ? _copy_to_user+0x4f/0x60
[   55.371620]  ? mem_cgroup_commit_charge+0x1f5/0x290
[   55.372127]  ? _copy_from_user+0x5e/0x90
[   55.372720]  ucma_write+0x174/0x1f0
[   55.373090]  ? ucma_close_id+0x40/0x40
[   55.373805]  ? __lru_cache_add+0xa8/0xd0
[   55.374403]  __vfs_write+0xc4/0x350
[   55.374774]  ? kernel_read+0xa0/0xa0
[   55.375173]  ? fsnotify+0x899/0x8f0
[   55.375544]  ? fsnotify_unmount_inodes+0x170/0x170
[   55.376689]  ? __fsnotify_update_child_dentry_flags+0x30/0x30
[   55.377522]  ? handle_mm_fault+0x174/0x320
[   55.378169]  vfs_write+0xf7/0x280
[   55.378864]  SyS_write+0xa1/0x120
[   55.379270]  ? SyS_read+0x120/0x120
[   55.379643]  ? mm_fault_error+0x180/0x180
[   55.380071]  ? task_work_run+0x7d/0xd0
[   55.380910]  ? __task_pid_nr_ns+0x120/0x140
[   55.381366]  ? SyS_read+0x120/0x120
[   55.381739]  do_syscall_64+0xeb/0x250
[   55.382143]  entry_SYSCALL_64_after_hwframe+0x21/0x86
[   55.382841] RIP: 0033:0x7fc2ef803e99
[   55.383227] RSP: 002b:00007fffcc5f3be8 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
[   55.384173] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc2ef803e99
[   55.386145] RDX: 0000000000000057 RSI: 0000000020000080 RDI: 0000000000000003
[   55.388418] RBP: 00007fffcc5f3c00 R08: 0000000000000000 R09: 0000000000000000
[   55.390542] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000400480
[   55.392916] R13: 00007fffcc5f3cf0 R14: 0000000000000000 R15: 0000000000000000
[   55.521088] Code: e5 4d 1e ff 48 89 df 44 0f b6 b3 b8 01 00 00 e8 65 50 1e ff 4c 8b 2b 49
8d bd b0 00 00 00 e8 56 50 1e ff 41 0f b6 c6 48 c1 e0 04 <49> 03 85 b0 00 00 00 48 8d 78 08
48 89 04 24 e8 3a 4f 1e ff 48
[   55.525980] RIP: rdma_init_qp_attr+0x52/0x2c0 RSP: ffff8801e2c2f9d8
[   55.532648] CR2: 00000000000000b0
[   55.534396] ---[ end trace 70cee64090251c0b ]---

Fixes: 75216638572f ("RDMA/cma: Export rdma cm interface to userspace")
Fixes: d541e45500bd ("IB/core: Convert ah_attr from OPA to IB when copying to user")
Reported-by: <syzbot+7b62c837c2516f8f38c8@syzkaller.appspotmail.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
1 parent 9137108
Raw File
bootgraph.pl
#!/usr/bin/env perl

# Copyright 2008, Intel Corporation
#
# This file is part of the Linux kernel
#
# This program file is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program in a file named COPYING; if not, write to the
# Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301 USA
#
# Authors:
# 	Arjan van de Ven <arjan@linux.intel.com>


#
# This script turns a dmesg output into a SVG graphic that shows which
# functions take how much time. You can view SVG graphics with various
# programs, including Inkscape, The Gimp and Firefox.
#
#
# For this script to work, the kernel needs to be compiled with the
# CONFIG_PRINTK_TIME configuration option enabled, and with
# "initcall_debug" passed on the kernel command line.
#
# usage:
# 	dmesg | perl scripts/bootgraph.pl > output.svg
#

use strict;
use Getopt::Long;
my $header = 0;

sub help {
	my $text = << "EOM";
Usage:
1) dmesg | perl scripts/bootgraph.pl [OPTION] > output.svg
2) perl scripts/bootgraph.pl -h

Options:
	-header	Insert kernel version and date
EOM
	my $std=shift;
	if ($std == 1) {
		print STDERR $text;
	} else {
		print $text;
	}
	exit;
}

GetOptions(
	'h|help'	=>\&help,
	'header'	=>\$header
);

my %start;
my %end;
my %type;
my $done = 0;
my $maxtime = 0;
my $firsttime = 99999;
my $count = 0;
my %pids;
my %pidctr;

my $headerstep = 20;
my $xheader = 15;
my $yheader = 25;
my $cyheader = 0;

while (<>) {
	my $line = $_;
	if ($line =~ /([0-9\.]+)\] calling  ([a-zA-Z0-9\_\.]+)\+/) {
		my $func = $2;
		if ($done == 0) {
			$start{$func} = $1;
			$type{$func} = 0;
			if ($1 < $firsttime) {
				$firsttime = $1;
			}
		}
		if ($line =~ /\@ ([0-9]+)/) {
			$pids{$func} = $1;
		}
		$count = $count + 1;
	}

	if ($line =~ /([0-9\.]+)\] async_waiting @ ([0-9]+)/) {
		my $pid = $2;
		my $func;
		if (!defined($pidctr{$pid})) {
			$func = "wait_" . $pid . "_1";
			$pidctr{$pid} = 1;
		} else {
			$pidctr{$pid} = $pidctr{$pid} + 1;
			$func = "wait_" . $pid . "_" . $pidctr{$pid};
		}
		if ($done == 0) {
			$start{$func} = $1;
			$type{$func} = 1;
			if ($1 < $firsttime) {
				$firsttime = $1;
			}
		}
		$pids{$func} = $pid;
		$count = $count + 1;
	}

	if ($line =~ /([0-9\.]+)\] initcall ([a-zA-Z0-9\_\.]+)\+.*returned/) {
		if ($done == 0) {
			$end{$2} = $1;
			$maxtime = $1;
		}
	}

	if ($line =~ /([0-9\.]+)\] async_continuing @ ([0-9]+)/) {
		my $pid = $2;
		my $func =  "wait_" . $pid . "_" . $pidctr{$pid};
		$end{$func} = $1;
		$maxtime = $1;
	}
	if ($line =~ /Write protecting the/) {
		$done = 1;
	}
	if ($line =~ /Freeing unused kernel memory/) {
		$done = 1;
	}
}

if ($count == 0) {
    print STDERR <<END;
No data found in the dmesg. Make sure that 'printk.time=1' and
'initcall_debug' are passed on the kernel command line.
END
	help(1);
    exit 1;
}

print "<?xml version=\"1.0\" standalone=\"no\"?> \n";
print "<svg width=\"2000\" height=\"100%\" version=\"1.1\" xmlns=\"http://www.w3.org/2000/svg\">\n";


if ($header) {
	my $version = `uname -a`;
	my $date = `date`;
	print "<text transform=\"translate($xheader,$yheader)\">Kernel version: $version</text>\n";
	$cyheader = $yheader+$headerstep;
	print "<text transform=\"translate($xheader,$cyheader)\">Date: $date</text>\n";
}

my @styles;

$styles[0] = "fill:rgb(0,0,255);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[1] = "fill:rgb(0,255,0);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[2] = "fill:rgb(255,0,20);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[3] = "fill:rgb(255,255,20);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[4] = "fill:rgb(255,0,255);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[5] = "fill:rgb(0,255,255);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[6] = "fill:rgb(0,128,255);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[7] = "fill:rgb(0,255,128);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[8] = "fill:rgb(255,0,128);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[9] = "fill:rgb(255,255,128);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[10] = "fill:rgb(255,128,255);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";
$styles[11] = "fill:rgb(128,255,255);fill-opacity:0.5;stroke-width:1;stroke:rgb(0,0,0)";

my $style_wait = "fill:rgb(128,128,128);fill-opacity:0.5;stroke-width:0;stroke:rgb(0,0,0)";

my $mult = 1950.0 / ($maxtime - $firsttime);
my $threshold2 = ($maxtime - $firsttime) / 120.0;
my $threshold = $threshold2/10;
my $stylecounter = 0;
my %rows;
my $rowscount = 1;
my @initcalls = sort { $start{$a} <=> $start{$b} } keys(%start);

foreach my $key (@initcalls) {
	my $duration = $end{$key} - $start{$key};

	if ($duration >= $threshold) {
		my ($s, $s2, $s3, $e, $w, $y, $y2, $style);
		my $pid = $pids{$key};

		if (!defined($rows{$pid})) {
			$rows{$pid} = $rowscount;
			$rowscount = $rowscount + 1;
		}
		$s = ($start{$key} - $firsttime) * $mult;
		$s2 = $s + 6;
		$s3 = $s + 1;
		$e = ($end{$key} - $firsttime) * $mult;
		$w = $e - $s;

		$y = $rows{$pid} * 150;
		$y2 = $y + 4;

		$style = $styles[$stylecounter];
		$stylecounter = $stylecounter + 1;
		if ($stylecounter > 11) {
			$stylecounter = 0;
		};

		if ($type{$key} == 1) {
			$y = $y + 15;
			print "<rect x=\"$s\" width=\"$w\" y=\"$y\" height=\"115\" style=\"$style_wait\"/>\n";
		} else {
			print "<rect x=\"$s\" width=\"$w\" y=\"$y\" height=\"145\" style=\"$style\"/>\n";
			if ($duration >= $threshold2) {
				print "<text transform=\"translate($s2,$y2) rotate(90)\">$key</text>\n";
			} else {
				print "<text transform=\"translate($s3,$y2) rotate(90)\" font-size=\"3pt\">$key</text>\n";
			}
		}
	}
}


# print the time line on top
my $time = $firsttime;
my $step = ($maxtime - $firsttime) / 15;
while ($time < $maxtime) {
	my $s3 = ($time - $firsttime) * $mult;
	my $tm = int($time * 100) / 100.0;
	print "<text transform=\"translate($s3,89) rotate(90)\">$tm</text>\n";
	$time = $time + $step;
}

print "</svg>\n";
back to top