• Yishai Hadas's avatar
    IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate · dfccdac6
    Yishai Hadas authored
    commit 7b21b69a upstream.
    
    The vma->vm_mm can become impossible to get before rdma_umap_close() is
    called, in this case we must not try to get an mm that is already
    undergoing process exit. In this case there is no need to wait for
    anything as the VMA will be destroyed by another thread soon and is
    already effectively 'unreachable' by userspace.
    
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
     PGD 800000012bc50067 P4D 800000012bc50067 PUD 129db5067 PMD 0
     Oops: 0000 [#1] SMP PTI
     CPU: 1 PID: 2050 Comm: bash Tainted: G        W  OE 4.20.0-rc6+ #3
     Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
     RIP: 0010:__rb_erase_color+0xb9/0x280
     Code: 84 17 01 00 00 48 3b 68 10 0f 84 15 01 00 00 48 89
                   58 08 48 89 de 48 89 ef 4c 89 e3 e8 90 84 22 00 e9 60 ff ff ff 48 8b 5d
                   10 <f6> 03 01 0f 84 9c 00 00 00 48 8b 43 10 48 85 c0 74 09 f6 00 01 0f
     RSP: 0018:ffffbecfc090bab8 EFLAGS: 00010246
     RAX: ffff97616346cf30 RBX: 0000000000000000 RCX: 0000000000000101
     RDX: 0000000000000000 RSI: ffff97623b6ca828 RDI: ffff97621ef10828
     RBP: ffff97621ef10828 R08: ffff97621ef10828 R09: 0000000000000000
     R10: 0000000000000000 R11: 0000000000000000 R12: ffff97623b6ca838
     R13: ffffffffbb3fef50 R14: ffff97623b6ca828 R15: 0000000000000000
     FS:  00007f7a5c31d740(0000) GS:ffff97623bb00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000000000000000 CR3: 000000011255a000 CR4: 00000000000006e0
     Call Trace:
      unlink_file_vma+0x3b/0x50
      free_pgtables+0xa1/0x110
      exit_mmap+0xca/0x1a0
      ? mlx5_ib_dealloc_pd+0x28/0x30 [mlx5_ib]
      mmput+0x54/0x140
      uverbs_user_mmap_disassociate+0xcc/0x160 [ib_uverbs]
      uverbs_destroy_ufile_hw+0xf7/0x120 [ib_uverbs]
      ib_uverbs_remove_one+0xea/0x240 [ib_uverbs]
      ib_unregister_device+0xfb/0x200 [ib_core]
      mlx5_ib_remove+0x51/0xe0 [mlx5_ib]
      mlx5_remove_device+0xc1/0xd0 [mlx5_core]
      mlx5_unregister_device+0x3d/0xb0 [mlx5_core]
      remove_one+0x2a/0x90 [mlx5_core]
      pci_device_remove+0x3b/0xc0
      device_release_driver_internal+0x16d/0x240
      unbind_store+0xb2/0x100
      kernfs_fop_write+0x102/0x180
      __vfs_write+0x36/0x1a0
      ? __alloc_fd+0xa9/0x170
      ? set_close_on_exec+0x49/0x70
      vfs_write+0xad/0x1a0
      ksys_write+0x52/0xc0
      do_syscall_64+0x5b/0x180
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Cc: <stable@vger.kernel.org> # 4.19
    Fixes: 5f9794dc ("RDMA/ucontext: Add a core API for mmaping driver IO memory")
    Signed-off-by: 's avatarYishai Hadas <yishaih@mellanox.com>
    Signed-off-by: 's avatarLeon Romanovsky <leonro@mellanox.com>
    Signed-off-by: 's avatarJason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    dfccdac6
uverbs_main.c 40.7 KB