In the Linux kernel, the following vulnerability has been resolved:
RDMA/cma: Allow UD qp_type to join multicast only
As for multicast: - The SIDR is the only mode that makes sense; - Besides PSUDP, other port spaces like PSIB is also allowed, as it is UD compatible. In this case qkey also needs to be set [1].
This patch allows only UD qp_type to join multicast, and set qkey to default if it's not set, to fix an uninit-value error: the ib->rec.qkey field is accessed without being initialized.
===================================================== BUG: KMSAN: uninit-value in cmasetqkey drivers/infiniband/core/cma.c:510 [inline] BUG: KMSAN: uninit-value in cmamakemcevent+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cmasetqkey drivers/infiniband/core/cma.c:510 [inline] cmamakemcevent+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cmaiboejoinmulticast drivers/infiniband/core/cma.c:4782 [inline] rdmajoinmulticast+0x2b83/0x30a0 drivers/infiniband/core/cma.c:4814 ucmaprocessjoin+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 ucmajoinmulticast+0x1e3/0x250 drivers/infiniband/core/ucma.c:1546 ucmawrite+0x639/0x6d0 drivers/infiniband/core/ucma.c:1732 vfswrite+0x8ce/0x2030 fs/readwrite.c:588 ksyswrite+0x28c/0x520 fs/readwrite.c:643 _dosyswrite fs/readwrite.c:655 [inline] _sesyswrite fs/readwrite.c:652 [inline] _ia32syswrite+0xdb/0x120 fs/readwrite.c:652 dosyscall32irqson arch/x86/entry/common.c:114 [inline] _dofastsyscall32+0x96/0xf0 arch/x86/entry/common.c:180 dofastsyscall32+0x34/0x70 arch/x86/entry/common.c:205 doSYSENTER32+0x1b/0x20 arch/x86/entry/common.c:248 entrySYSENTERcompatafter_hwframe+0x4d/0x5c
Local variable ib.i created at: cmaiboejoinmulticast drivers/infiniband/core/cma.c:4737 [inline] rdmajoinmulticast+0x586/0x30a0 drivers/infiniband/core/cma.c:4814 ucmaprocess_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479
CPU: 0 PID: 29874 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0
[1] https://lore.kernel.org/linux-rdma/20220117183832.GD84788@nvidia.com/
[
{
"deprecated": false,
"id": "CVE-2023-53525-2af9a8a7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "199379980338671820206891822817077686193",
"length": 1068.0
},
"target": {
"function": "cma_make_mc_event",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-2be8a78a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "321168416328787461562019664169830605457",
"length": 1084.0
},
"target": {
"function": "rdma_join_multicast",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-8780bc30",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "213481924012602765406638734223102561250",
"length": 723.0
},
"target": {
"function": "cma_ib_init_qp_attr",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-9682c9f8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "325154032601380377753808874162316129142",
"length": 1201.0
},
"target": {
"function": "cma_join_ib_multicast",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-afb050fb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "210292489747219946516651438281993353276",
"length": 533.0
},
"target": {
"function": "cma_ib_mc_handler",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-b7a3efd9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "288964822059812870031138098808847901371",
"length": 1492.0
},
"target": {
"function": "cma_iboe_join_multicast",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-e65364cf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"line_hashes": [
"23911603136510044987156341349934479895",
"305089891473842146773647637003581565920",
"11654920327207704519424121922076979041",
"63268998052988305852186928414261238444",
"326381311134807453881311368556755295744",
"119636152914486023988440347944450581350",
"89022389746763455695688884957070773981",
"234481837080769882599167513318888113349",
"170616783200697629502667864867288217221",
"333758827187148957110085487710366683208",
"50579569089093083002013706917251940064",
"268894201324088089461502235472167441950",
"284845641064722112193944421866632802565",
"311371889740661158126527909263257910692",
"54119019154611369967268863054260859200",
"29285002169209400892400388667270294038",
"5158329863878590430773962736771008245",
"261353352379786811897368509340536267213",
"103010811118808618187486948472977507228",
"124748521093141018469169155314210496772",
"297595851486489933795793623181773483894",
"193608214099754475503594168783638213418",
"34963158372273357499869901432366906321",
"108299757688463390745218794159343796855",
"111088741899378919153580016430919558289",
"275442834875574909480197707592760712872",
"296215223744953752058312619503836969856",
"9431383765551068438623868063988821188",
"244261520870116955079951482013575795850",
"206954344755057838062986250348444465978",
"39543285615129215757313702186064057839",
"277488659609243526529721025745449583558",
"144047898546305820349196081210232691145",
"332779765776594258289964670625779827254",
"237953588457538102910357922043998898813",
"178792058872012169145443719927758548223",
"322854733150815840993217067058181864932",
"9384861715226503781221420071714730262",
"255275472658432850973841376812472803843",
"83839109274722344234034924856618027619",
"21116797241095206902912076747095445366",
"25747707210587995779111714113970469695",
"7345307151396212408027071037638532287",
"33630553333374253842629399208425822612",
"239302529561190217638972906436959963035",
"263222104757984881067109278837195817174",
"279107051944949192274652400502874070855",
"1662847667887560833926083286826039452",
"182864855630878043652972208107855032320",
"214912928894896371463395486195583298458",
"100907680547962725953407881494038725909",
"131777582275098441261917851033877774456",
"238819808291165117460936718238276235124",
"109627019445532194084495596629331746634",
"198481012827266028076181715762429180970",
"133767055685942045326483830514893295089",
"5833840935322434534760580571742929454",
"68533855072772607410156595166327958711",
"70500061226145714862164068058030130744"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-f5d9104e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "116066880046712484736545814718754855580",
"length": 620.0
},
"target": {
"function": "cma_set_qkey",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53525-f8228018",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02eabb635bc64bd1e3a7cf887d6d182bffb64b99",
"digest": {
"function_hash": "323668007264718214906175151573191703112",
"length": 565.0
},
"target": {
"function": "cma_send_sidr_rep",
"file": "drivers/infiniband/core/cma.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]