| 2019-11-26 08:41:31 |
Fred Kimmy |
bug |
|
|
added bug |
| 2019-11-29 08:41:53 |
Ike Panhc |
nominated for series |
|
kunpeng920/upstream-kernel |
|
| 2019-11-29 08:41:53 |
Ike Panhc |
bug task added |
|
kunpeng920/upstream-kernel |
|
| 2019-11-29 08:41:53 |
Ike Panhc |
nominated for series |
|
kunpeng920/ubuntu-18.04-hwe |
|
| 2019-11-29 08:41:53 |
Ike Panhc |
bug task added |
|
kunpeng920/ubuntu-18.04-hwe |
|
| 2019-11-29 08:41:53 |
Ike Panhc |
nominated for series |
|
kunpeng920/ubuntu-20.04 |
|
| 2019-11-29 08:41:53 |
Ike Panhc |
bug task added |
|
kunpeng920/ubuntu-20.04 |
|
| 2019-11-29 08:42:04 |
Ike Panhc |
kunpeng920/upstream-kernel: milestone |
|
linux-v5.4 |
|
| 2019-11-29 08:42:09 |
Ike Panhc |
kunpeng920/upstream-kernel: status |
New |
Fix Released |
|
| 2019-11-29 09:07:00 |
Ike Panhc |
kunpeng920/ubuntu-20.04: milestone |
|
ubuntu-20.04-ga |
|
| 2019-11-29 09:07:05 |
Ike Panhc |
kunpeng920/ubuntu-18.04-hwe: milestone |
|
ubuntu-18.04.5 |
|
| 2019-12-11 00:12:49 |
dann frazier |
kunpeng920/ubuntu-18.04-hwe: status |
New |
Fix Committed |
|
| 2019-12-11 00:12:59 |
dann frazier |
nominated for series |
|
kunpeng920/ubuntu-18.04 |
|
| 2019-12-11 00:12:59 |
dann frazier |
bug task added |
|
kunpeng920/ubuntu-18.04 |
|
| 2019-12-11 00:12:59 |
dann frazier |
nominated for series |
|
kunpeng920/ubuntu-19.10 |
|
| 2019-12-11 00:12:59 |
dann frazier |
bug task added |
|
kunpeng920/ubuntu-19.10 |
|
| 2019-12-11 00:12:59 |
dann frazier |
nominated for series |
|
kunpeng920/ubuntu-19.04 |
|
| 2019-12-11 00:12:59 |
dann frazier |
bug task added |
|
kunpeng920/ubuntu-19.04 |
|
| 2019-12-12 00:11:41 |
dann frazier |
kunpeng920/ubuntu-20.04: status |
New |
Fix Committed |
|
| 2019-12-18 08:47:11 |
Ike Panhc |
kunpeng920/ubuntu-19.10: status |
New |
In Progress |
|
| 2019-12-18 08:47:17 |
Ike Panhc |
kunpeng920/ubuntu-19.04: status |
New |
In Progress |
|
| 2019-12-18 08:47:20 |
Ike Panhc |
kunpeng920/ubuntu-18.04: status |
New |
In Progress |
|
| 2019-12-18 08:47:22 |
Ike Panhc |
kunpeng920/ubuntu-18.04: assignee |
|
Ike Panhc (ikepanhc) |
|
| 2019-12-18 08:47:25 |
Ike Panhc |
kunpeng920/ubuntu-19.04: assignee |
|
Ike Panhc (ikepanhc) |
|
| 2019-12-18 08:47:27 |
Ike Panhc |
kunpeng920/ubuntu-19.10: assignee |
|
Ike Panhc (ikepanhc) |
|
| 2019-12-20 07:27:29 |
Ike Panhc |
bug task added |
|
linux (Ubuntu) |
|
| 2019-12-20 07:27:48 |
Ike Panhc |
nominated for series |
|
Ubuntu Eoan |
|
| 2019-12-20 07:27:48 |
Ike Panhc |
bug task added |
|
linux (Ubuntu Eoan) |
|
| 2019-12-20 07:27:48 |
Ike Panhc |
nominated for series |
|
Ubuntu Disco |
|
| 2019-12-20 07:27:48 |
Ike Panhc |
bug task added |
|
linux (Ubuntu Disco) |
|
| 2019-12-20 07:27:48 |
Ike Panhc |
nominated for series |
|
Ubuntu Bionic |
|
| 2019-12-20 07:27:48 |
Ike Panhc |
bug task added |
|
linux (Ubuntu Bionic) |
|
| 2019-12-20 07:30:09 |
Ubuntu Kernel Bot |
linux (Ubuntu): status |
New |
Incomplete |
|
| 2019-12-20 07:30:15 |
Ubuntu Kernel Bot |
linux (Ubuntu Bionic): status |
New |
Incomplete |
|
| 2019-12-20 07:30:17 |
Ubuntu Kernel Bot |
linux (Ubuntu Disco): status |
New |
Incomplete |
|
| 2019-12-20 07:30:19 |
Ubuntu Kernel Bot |
linux (Ubuntu Eoan): status |
New |
Incomplete |
|
| 2019-12-20 08:57:27 |
Ike Panhc |
linux (Ubuntu Eoan): status |
Incomplete |
In Progress |
|
| 2019-12-20 08:57:27 |
Ike Panhc |
linux (Ubuntu Eoan): assignee |
|
Ike Panhc (ikepanhc) |
|
| 2019-12-20 08:57:39 |
Ike Panhc |
linux (Ubuntu Disco): status |
Incomplete |
In Progress |
|
| 2019-12-20 08:57:39 |
Ike Panhc |
linux (Ubuntu Disco): assignee |
|
Ike Panhc (ikepanhc) |
|
| 2019-12-20 08:57:50 |
Ike Panhc |
linux (Ubuntu Bionic): status |
Incomplete |
In Progress |
|
| 2019-12-20 08:57:50 |
Ike Panhc |
linux (Ubuntu Bionic): assignee |
|
Ike Panhc (ikepanhc) |
|
| 2019-12-20 08:58:00 |
Ike Panhc |
linux (Ubuntu): status |
Incomplete |
Invalid |
|
| 2019-12-20 08:58:12 |
Ike Panhc |
kunpeng920: status |
New |
In Progress |
|
| 2019-12-20 08:58:19 |
Ike Panhc |
kunpeng920: assignee |
|
Ike Panhc (ikepanhc) |
|
| 2019-12-20 09:03:07 |
Ike Panhc |
description |
"[Bug Description]
KASAN: slab-out-of-bounds in hns_roce_table_mhop_put+0x584/0x828
[hns_roce]
Read of size 8 at addr ffff802185e08300 by task rmmod/270
Call trace:
dump_backtrace+0x0/0x1e8
show_stack+0x14/0x20
dump_stack+0xc4/0xfc
print_address_description+0x60/0x270
__kasan_report+0x164/0x1b8
kasan_report+0xc/0x18
__asan_load8+0x84/0xa8
hns_roce_table_mhop_put+0x584/0x828 [hns_roce]
hns_roce_table_put+0x174/0x1a0 [hns_roce]
hns_roce_mr_free+0x124/0x210 [hns_roce]
hns_roce_dereg_mr+0x90/0xb8 [hns_roce]
ib_dealloc_pd_user+0x60/0xf0
ib_mad_port_close+0x128/0x1d8
ib_mad_remove_device+0x94/0x118
remove_client_context+0xa0/0xe0
disable_device+0xfc/0x1c0
__ib_unregister_device+0x60/0xe0
ib_unregister_device+0x24/0x38
hns_roce_exit+0x3c/0x138 [hns_roce]
__hns_roce_hw_v2_uninit_instance.isra.30+0x28/0x50 [hns_roce_hw_v2]
hns_roce_hw_v2_uninit_instance+0x44/0x60 [hns_roce_hw_v2]
hclge_uninit_client_instance+0x15c/0x238 [hclge]
hnae3_uninit_client_instance+0x84/0xa8 [hnae3]
hnae3_unregister_client+0x84/0x158 [hnae3]
hns_roce_hw_v2_exit+0x14/0x20 [hns_roce_hw_v2]
__arm64_sys_delete_module+0x20c/0x308
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc
Allocated by task 255:
__kasan_kmalloc.isra.0+0xd0/0x180
kasan_kmalloc+0xc/0x18
__kmalloc+0x16c/0x328
hns_roce_init_hem_table+0x20c/0x428 [hns_roce]
hns_roce_init+0x214/0xfe0 [hns_roce]
__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
hclge_init_roce_client_instance+0x180/0x310 [hclge]
hclge_init_client_instance+0xcc/0x508 [hclge]
hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
hnae3_register_client+0x134/0x1a8 [hnae3]
0xffff200009c00014
do_one_initcall+0x9c/0x3e0
do_init_module+0xd4/0x2d8
load_module+0x3284/0x3690
__se_sys_init_module+0x274/0x308
__arm64_sys_init_module+0x40/0x50
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc
Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff802185e06300
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 0 bytes to the right of
8192-byte region [ffff802185e06300, ffff802185e08300)
The buggy address belongs to the page:
page:ffff7fe008617800 refcount:1 mapcount:0 mapping:ffff802340020e00 index:0x0
compound_mapcount: 0
flags: 0x5fffe00000010200(slab|head)
raw: 5fffe00000010200 dead000000000100 dead000000000200 ffff802340020e00
raw: 0000000000000000 00000000803e003e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff802185e08200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff802185e08280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff802185e08300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff802185e08380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff802185e08400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Disabling lock debugging due to kernel taint
[Steps to Reproduce]
Enable KASAN and configure PAGE_SIZE to 64K, insmod hns roce driver and then rmmod it.
[Actual Results]
Call trace because of slab-out-of-bound.
[Expected Results]
Success
[Reproducibility]
Inevitably
[Additional information]
Hardware: D06 CS
Firmware: NA
Kernel: NA
[Resolution]
Not configure eq->next when number of eq_buf is 1 in eq_mhop_alloc()."
RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver
RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver |
[Impact]
KASAN reports slab-out-of-bounds in RDMA/hns driver
[Testcase]
Enable KASAN and modprobe RDMA/hns driver
[Regression Risk]
Only RDMA/hns driver modified. lowest risk to other drivers/platforms
[Bug Description]
KASAN: slab-out-of-bounds in hns_roce_table_mhop_put+0x584/0x828
[hns_roce]
Read of size 8 at addr ffff802185e08300 by task rmmod/270
Call trace:
dump_backtrace+0x0/0x1e8
show_stack+0x14/0x20
dump_stack+0xc4/0xfc
print_address_description+0x60/0x270
__kasan_report+0x164/0x1b8
kasan_report+0xc/0x18
__asan_load8+0x84/0xa8
hns_roce_table_mhop_put+0x584/0x828 [hns_roce]
hns_roce_table_put+0x174/0x1a0 [hns_roce]
hns_roce_mr_free+0x124/0x210 [hns_roce]
hns_roce_dereg_mr+0x90/0xb8 [hns_roce]
ib_dealloc_pd_user+0x60/0xf0
ib_mad_port_close+0x128/0x1d8
ib_mad_remove_device+0x94/0x118
remove_client_context+0xa0/0xe0
disable_device+0xfc/0x1c0
__ib_unregister_device+0x60/0xe0
ib_unregister_device+0x24/0x38
hns_roce_exit+0x3c/0x138 [hns_roce]
__hns_roce_hw_v2_uninit_instance.isra.30+0x28/0x50 [hns_roce_hw_v2]
hns_roce_hw_v2_uninit_instance+0x44/0x60 [hns_roce_hw_v2]
hclge_uninit_client_instance+0x15c/0x238 [hclge]
hnae3_uninit_client_instance+0x84/0xa8 [hnae3]
hnae3_unregister_client+0x84/0x158 [hnae3]
hns_roce_hw_v2_exit+0x14/0x20 [hns_roce_hw_v2]
__arm64_sys_delete_module+0x20c/0x308
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc
Allocated by task 255:
__kasan_kmalloc.isra.0+0xd0/0x180
kasan_kmalloc+0xc/0x18
__kmalloc+0x16c/0x328
hns_roce_init_hem_table+0x20c/0x428 [hns_roce]
hns_roce_init+0x214/0xfe0 [hns_roce]
__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
hclge_init_roce_client_instance+0x180/0x310 [hclge]
hclge_init_client_instance+0xcc/0x508 [hclge]
hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
hnae3_register_client+0x134/0x1a8 [hnae3]
0xffff200009c00014
do_one_initcall+0x9c/0x3e0
do_init_module+0xd4/0x2d8
load_module+0x3284/0x3690
__se_sys_init_module+0x274/0x308
__arm64_sys_init_module+0x40/0x50
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc
Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff802185e06300
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 0 bytes to the right of
8192-byte region [ffff802185e06300, ffff802185e08300)
The buggy address belongs to the page:
page:ffff7fe008617800 refcount:1 mapcount:0 mapping:ffff802340020e00 index:0x0
compound_mapcount: 0
flags: 0x5fffe00000010200(slab|head)
raw: 5fffe00000010200 dead000000000100 dead000000000200 ffff802340020e00
raw: 0000000000000000 00000000803e003e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff802185e08200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff802185e08280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff802185e08300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff802185e08380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff802185e08400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Disabling lock debugging due to kernel taint
[Steps to Reproduce]
Enable KASAN and configure PAGE_SIZE to 64K, insmod hns roce driver and then rmmod it.
[Actual Results]
Call trace because of slab-out-of-bound.
[Expected Results]
Success
[Reproducibility]
Inevitably
[Additional information]
Hardware: D06 CS
Firmware: NA
Kernel: NA
[Resolution]
Not configure eq->next when number of eq_buf is 1 in eq_mhop_alloc().
RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver
RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver |
|
| 2020-01-07 11:41:43 |
Kleber Sacilotto de Souza |
linux (Ubuntu Bionic): status |
In Progress |
Fix Committed |
|
| 2020-01-07 11:42:37 |
Kleber Sacilotto de Souza |
linux (Ubuntu Disco): status |
In Progress |
Fix Committed |
|
| 2020-01-07 11:45:57 |
Kleber Sacilotto de Souza |
linux (Ubuntu Eoan): status |
In Progress |
Fix Committed |
|
| 2020-01-10 18:03:25 |
Ubuntu Kernel Bot |
tags |
|
verification-needed-disco |
|
| 2020-01-17 15:31:58 |
Ike Panhc |
tags |
verification-needed-disco |
verification-done-disco |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
linux (Ubuntu Disco): status |
Fix Committed |
Fix Released |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2019-14615 |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2019-18885 |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2019-19050 |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2019-19077 |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2019-19078 |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2019-19082 |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2019-19332 |
|
| 2020-01-27 13:21:23 |
Launchpad Janitor |
cve linked |
|
2020-7053 |
|
| 2020-01-28 10:18:30 |
Andrew Cloke |
kunpeng920/ubuntu-19.04: status |
In Progress |
Fix Released |
|
| 2020-01-28 10:18:30 |
Andrew Cloke |
kunpeng920/ubuntu-19.04: milestone |
|
ubuntu-19.04-sru-12 |
|
| 2020-01-28 10:18:52 |
Andrew Cloke |
kunpeng920/ubuntu-18.04-hwe: status |
Fix Committed |
Fix Released |
|
| 2020-01-28 10:18:52 |
Andrew Cloke |
kunpeng920/ubuntu-18.04-hwe: milestone |
ubuntu-18.04.5 |
ubuntu-18.04.3-sru-7 |
|
| 2020-02-03 22:38:46 |
Ubuntu Kernel Bot |
tags |
verification-done-disco |
verification-done-disco verification-needed-bionic |
|
| 2020-02-03 22:44:54 |
Ubuntu Kernel Bot |
tags |
verification-done-disco verification-needed-bionic |
verification-done-disco verification-needed-bionic verification-needed-eoan |
|
| 2020-02-05 06:54:07 |
Ike Panhc |
tags |
verification-done-disco verification-needed-bionic verification-needed-eoan |
verification-done-bionic verification-done-disco verification-done-eoan |
|
| 2020-02-13 09:15:46 |
Andrew Cloke |
kunpeng920/ubuntu-19.10: status |
In Progress |
Fix Committed |
|
| 2020-02-13 09:17:04 |
Andrew Cloke |
kunpeng920/ubuntu-18.04: status |
In Progress |
Fix Committed |
|
| 2020-02-13 09:17:16 |
Andrew Cloke |
kunpeng920: status |
In Progress |
Fix Committed |
|
| 2020-02-17 10:23:38 |
Launchpad Janitor |
linux (Ubuntu Eoan): status |
Fix Committed |
Fix Released |
|
| 2020-02-17 10:23:38 |
Launchpad Janitor |
cve linked |
|
2019-19965 |
|
| 2020-02-17 10:36:02 |
Launchpad Janitor |
linux (Ubuntu Bionic): status |
Fix Committed |
Fix Released |
|
| 2020-02-17 10:36:02 |
Launchpad Janitor |
cve linked |
|
2019-20096 |
|
| 2020-02-17 10:36:02 |
Launchpad Janitor |
cve linked |
|
2019-5108 |
|
| 2020-02-17 14:27:59 |
Andrew Cloke |
kunpeng920/ubuntu-18.04: status |
Fix Committed |
Fix Released |
|
| 2020-02-27 09:04:26 |
Ike Panhc |
kunpeng920/ubuntu-19.10: status |
Fix Committed |
Fix Released |
|
| 2020-04-24 10:49:25 |
Andrew Cloke |
kunpeng920/ubuntu-20.04: status |
Fix Committed |
Fix Released |
|
| 2020-04-27 06:56:31 |
Ike Panhc |
kunpeng920: status |
Fix Committed |
Fix Released |
|
