From: Norbert Szetei rxe_ib_advise_mr_prefetch() and rxe_ib_prefetch_sg_list() look up the MR by lkey and hand it to rxe_odp_do_pagefault_and_lock() without checking that it is an ODP MR. That path runs to_ib_umem_odp() on mr->umem, and for a non-ODP MR mr->umem is a plain struct ib_umem from ib_umem_get(), so the container_of() in to_ib_umem_odp() lands past the end of the object and ib_umem_odp_map_dma_and_lock() reads its ib_umem_odp fields out of bounds. lookup_mr() validates the lkey, PD, access and state but not the MR type, and IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH is accepted for any MR. BUG: KASAN: slab-out-of-bounds in ib_umem_odp_map_dma_and_lock+0x884/0x8a0 Read of size 8 at addr ffff88810a3ebcf0 by task advi/921 ib_umem_odp_map_dma_and_lock+0x884/0x8a0 rxe_ib_advise_mr+0x543/0xad0 ib_uverbs_handler_UVERBS_METHOD_ADVISE_MR+0x446/0x530 ib_uverbs_cmd_verbs+0x2b3c/0x3b20 ib_uverbs_ioctl+0x1e3/0x310 Allocated by task 921: __ib_umem_get_va+0x13e/0xae0 rxe_mr_init_user+0x2ae/0xb00 rxe_reg_user_mr+0x337/0x510 The buggy address belongs to the object at ffff88810a3ebc80 which belongs to the cache kmalloc-96 of size 96 Ask lookup_mr() for IB_ACCESS_ON_DEMAND in both the synchronous and the asynchronous prefetch arm. mr->access carries that flag only for an MR registered as ODP, so the existing (access & mr->access) != access test rejects a plain MR and the prefetch fails with -EINVAL. Fixes: 3576b0df1588 ("RDMA/rxe: Implement synchronous prefetch for ODP MRs") Cc: stable@vger.kernel.org Signed-off-by: Norbert Szetei --- drivers/infiniband/sw/rxe/rxe_odp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_odp.c b/drivers/infiniband/sw/rxe/rxe_odp.c index ab21b620e94c..c375d3efd999 100644 --- a/drivers/infiniband/sw/rxe/rxe_odp.c +++ b/drivers/infiniband/sw/rxe/rxe_odp.c @@ -469,7 +469,7 @@ static int rxe_ib_prefetch_sg_list(struct ib_pd *ibpd, struct rxe_mr *mr; struct ib_umem_odp *umem_odp; - mr = lookup_mr(pd, IB_ACCESS_LOCAL_WRITE, + mr = lookup_mr(pd, IB_ACCESS_LOCAL_WRITE | IB_ACCESS_ON_DEMAND, sg_list[i].lkey, RXE_LOOKUP_LOCAL); if (!mr) { @@ -535,7 +535,7 @@ static int rxe_ib_advise_mr_prefetch(struct ib_pd *ibpd, for (i = 0; i < num_sge; ++i) { /* Takes a reference, which will be released in the queued work */ - mr = lookup_mr(pd, IB_ACCESS_LOCAL_WRITE, + mr = lookup_mr(pd, IB_ACCESS_LOCAL_WRITE | IB_ACCESS_ON_DEMAND, sg_list[i].lkey, RXE_LOOKUP_LOCAL); if (!mr) { mr = ERR_PTR(-EINVAL); -- 2.55.0