Messages in this thread Patch in this message | | | From | Hongbo Yao <> | Subject | [PATCH] nvme: fix out of bounds access in nvme_cqe_pending | Date | Mon, 7 Jan 2019 10:22:07 +0800 |
| |
There is an out of bounds array access in nvme_cqe_peding().
When enable irq_thread for nvme interrupt, there is racing between the nvmeq->cq_head updating and reading.
nvmeq->cq_head is updated in nvme_update_cq_head(), if nvmeq->cq_head equals nvmeq->q_depth and before its value set to zero, nvme_cqe_pending() uses its value as an array index, the index will be out of bounds.
(When enabled nvme.using_thread_interrupts=1 in cmdline, i found this abnormal address access).
[ 100.299140] Unable to handle kernel paging request at virtual address ffff00002416500e [ 100.307046] Mem abort info: [ 100.309826] ESR = 0x96000007 [ 100.312867] Exception class = DABT (current EL), IL = 32 bits [ 100.318771] SET = 0, FnV = 0 [ 100.321811] EA = 0, S1PTW = 0 [ 100.324938] Data abort info: [ 100.327805] ISV = 0, ISS = 0x00000007 [ 100.331626] CM = 0, WnR = 0 [ 100.334581] swapper pgtable: 4k pages, 48-bit VAs, pgdp = 00000000a9f05748 [ 100.341441] [ffff00002416500e] pgd=00000a5fffffe803, pud=00000a5fffffd803, pmd=0000003f780ac003, pte=0000000000000000 [ 100.352038] Internal error: Oops: 96000007 [#1] PREEMPT SMP [ 100.357597] Modules linked in: hns_roce_hw_v2(O) hns_roce(O) hns3(O) hclge(O) hnae3(O) [ 100.365505] CPU: 28 PID: 2888 Comm: irq/162-nvme0q7 Tainted: G O 4.19.0-g45910de #1 [ 100.374449] Hardware name: Huawei D06/D06, BIOS Hisilicon D06 UEFI RC0 - B080 (V8.01) 11/30/2018 [ 100.383218] pstate: 00400089 (nzcv daIf +PAN -UAO) [ 100.387999] pc : nvme_irq_check+0x10/0x28 [ 100.391995] lr : __handle_irq_event_percpu+0x70/0x2c8 [ 100.397032] sp : ffff000009ac3e60 [ 100.400333] x29: ffff000009ac3e60 x28: ffff803f73690d80 [ 100.405631] x27: ffff805f78494400 x26: ffff0000097d1000 [ 100.410930] x25: ffff000009ac3f04 x24: ffff0000097a2018 [ 100.416228] x23: ffff0000097d1b40 x22: 00000000000000a2 [ 100.421526] x21: 0000000000000000 x20: ffff805f78494438 [ 100.426825] x19: ffff803f70384480 x18: 0000000000000400 [ 100.432123] x17: 0000000000000000 x16: 0000000000000000 [ 100.437421] x15: 0000000000000400 x14: 0000000000000400 [ 100.442719] x13: 0000000000000000 x12: 0000000000000000 [ 100.448018] x11: 0000000000000000 x10: 0000000000000040 [ 100.453317] x9 : ffff0000097effe0 x8 : ffff803f775db908 [ 100.458615] x7 : ffff803f775dba40 x6 : 0000000000000110 [ 100.463913] x5 : ffff803f775db908 x4 : 0000805f7626a000 [ 100.469212] x3 : 0000000000000000 x2 : ffff000024161000 [ 100.474510] x1 : 0000000000000001 x0 : ffff000024165000 [ 100.479809] Process irq/162-nvme0q7 (pid: 2888, stack limit = 0x000000007f43f8e5) [ 100.487276] Call trace: [ 100.489710] nvme_irq_check+0x10/0x28 [ 100.493358] handle_irq_event_percpu+0x34/0x88 [ 100.497787] handle_irq_event+0x48/0x78 [ 100.501610] handle_fasteoi_irq+0xa8/0x180 [ 100.505692] generic_handle_irq+0x24/0x38 [ 100.509688] __handle_domain_irq+0x5c/0xb0 [ 100.513770] gic_handle_irq+0x7c/0x180 [ 100.517504] el1_irq+0xb0/0x128 [ 100.520631] nvme_irq+0x108/0x150 [ 100.523933] irq_thread_fn+0x28/0x68 [ 100.527494] irq_thread+0x124/0x1d0 [ 100.530969] kthread+0x12c/0x130 [ 100.534183] ret_from_fork+0x10/0x18 [ 100.537745] Code: 7940ec20 f9402422 3941f021 8b001040 (79401c00) [ 100.543895] ---[ end trace 119829d132a82da5 ]--- [ 100.548499] Kernel panic - not syncing: Fatal exception in interrupt [ 100.554881] SMP: stopping secondary CPUs [ 100.575347] Kernel Offset: disabled [ 100.578822] CPU features: 0x0,22800a38 [ 100.582556] Memory Limit: none [ 100.585633] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Signed-off-by: Hongbo Yao <yaohongbo@huawei.com> --- drivers/nvme/host/pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index d668682..68375d4 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -908,9 +908,11 @@ static void nvme_complete_cqes(struct nvme_queue *nvmeq, u16 start, u16 end) static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) { - if (++nvmeq->cq_head == nvmeq->q_depth) { + if (nvmeq->cq_head == (nvmeq->q_depth - 1)) { nvmeq->cq_head = 0; nvmeq->cq_phase = !nvmeq->cq_phase; + } else { + ++nvmeq->cq_head; } } -- 1.8.3.1
| |