REDHAT-BUG-2528665: Medium severity Linux Linux kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix OOB in freerdatomicresources()
freerdatomicresources() iterates using qp->attr.maxdestrdatomic. Updating maxdestrdatomic before freeing the old array can make the free path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN: ================================================================== BUG: KASAN: slab-out-of-bounds in freerdatomicresource drivers/infiniband/sw/rxe/rxeqp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in rxeqpfromattr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxeqp.c:712 Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063
CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x10e/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0xf7/0x600 mm/kasan/report.c:482 kasanreport+0xe4/0x120 mm/kasan/report.c:595 freerdatomicresource drivers/infiniband/sw/rxe/rxeqp.c:180 [inline] freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:171 [inline] freerdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:163 [inline] rxeqpfromattr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxeqp.c:712 rxemodifyqp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxeverbs.c:623 ibsecuritymodifyqp+0x223/0xfa0 drivers/infiniband/core/security.c:625 ibmodifyqp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modifyqp+0x13ca/0x1940 drivers/infiniband/core/uverbscmd.c:1932 ibuverbsmodifyqp+0xcb/0x120 drivers/infiniband/core/uverbscmd.c:1958 ibuverbswrite+0xb86/0x1030 drivers/infiniband/core/uverbsmain.c:680 vfswrite+0x2aa/0x1070 fs/readwrite.c:686 ksyswrite+0x1f8/0x250 fs/readwrite.c:740 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x116/0x800 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIGRAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007 RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0 </TASK>
Allocated by task 11063: kasansavestack+0x33/0x60 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 poisonkmallocredzone mm/kasan/common.c:398 [inline] kasankmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 [inline] dokmallocnode mm/slub.c:5296 [inline] kmallocnoprof+0x32a/0x850 mm/slub.c:5308 kmallocnoprof include/linux/slab.h:954 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] allocrdatomicresources drivers/infiniband/sw/rxe/rxeqp.c:155 [inline] rxeqpfromattr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxeqp.c:714 rxemodifyqp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxeverbs.c:623 ibsecuritymodifyqp+0x223/0xfa0 drivers/infiniband/core/security.c:625 ibmodifyqp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modifyqp+0x13ca/0x1940 drivers/infiniband/core/uverbscmd.c:1932 ibuverbsmodifyqp+0xcb/0x120 drivers/infiniband/core/uverbscmd.c:1958 ibuverbswrite+0xb86/0x1030 drivers/infiniband/core/uverbsma ---truncated---
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's RDMA RXE software driver are relevant. The provided data does not identify specific kernel versions or distributions affected.
What condition triggers the out-of-bounds write?
The issue occurs when max_dest_rd_atomic is updated before the previously allocated RD atomic resource array is freed. The free path can then iterate using the new value rather than the size of the old allocation, writing past its bounds.
What evidence may indicate that the issue has been triggered?
KASAN can report a slab-out-of-bounds write in free_rd_atomic_resource(), free_rd_atomic_resources(), or rxe_qp_from_attr() in drivers/infiniband/sw/rxe/rxe_qp.c.