cve/published/2023/CVE-2023-53026.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2023-53026: RDMA/core: Fix ib block iterator counter overflow

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix ib block iterator counter overflow

When registering a new DMA MR after selecting the best aligned page size
for it, we iterate over the given sglist to split each entry to smaller,
aligned to the selected page size, DMA blocks.

In given circumstances where the sg entry and page size fit certain
sizes and the sg entry is not aligned to the selected page size, the
total size of the aligned pages we need to cover the sg entry is >= 4GB.
Under this circumstances, while iterating page aligned blocks, the
counter responsible for counting how much we advanced from the start of
the sg entry is overflowed because its type is u32 and we pass 4GB in
size. This can lead to an infinite loop inside the iterator function
because the overflow prevents the counter to be larger
than the size of the sg entry.

Fix the presented problem by changing the advancement condition to
eliminate overflow.

Backtrace:
[  192.374329] efa_reg_user_mr_dmabuf
[  192.376783] efa_register_mr
[  192.382579] pgsz_bitmap 0xfffff000 rounddown 0x80000000
[  192.386423] pg_sz [0x80000000] umem_length[0xc0000000]
[  192.392657] start 0x0 length 0xc0000000 params.page_shift 31 params.page_num 3
[  192.399559] hp_cnt[3], pages_in_hp[524288]
[  192.403690] umem->sgt_append.sgt.nents[1]
[  192.407905] number entries: [1], pg_bit: [31]
[  192.411397] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8]
[  192.415601] biter->__sg_advance [665837568] sg_dma_len[3221225472]
[  192.419823] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8]
[  192.423976] biter->__sg_advance [2813321216] sg_dma_len[3221225472]
[  192.428243] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8]
[  192.432397] biter->__sg_advance [665837568] sg_dma_len[3221225472]

The Linux kernel CVE team has assigned CVE-2023-53026 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.2 with commit a808273a495c657e33281b181fd7fcc2bb28f662 and fixed in 5.4.231 with commit 902063a9fea5f8252df392ade746bc9cfd07a5ae
	Issue introduced in 5.2 with commit a808273a495c657e33281b181fd7fcc2bb28f662 and fixed in 5.10.166 with commit d66c1d4178c219b6e7d7a6f714e3e3656faccc36
	Issue introduced in 5.2 with commit a808273a495c657e33281b181fd7fcc2bb28f662 and fixed in 5.15.91 with commit 362c9489720b31b6aa7491423ba65a4e98aa9838
	Issue introduced in 5.2 with commit a808273a495c657e33281b181fd7fcc2bb28f662 and fixed in 6.1.9 with commit 43811d07ea64366af8ec9e168c558ec51440c39e
	Issue introduced in 5.2 with commit a808273a495c657e33281b181fd7fcc2bb28f662 and fixed in 6.2 with commit 0afec5e9cea732cb47014655685a2a47fb180c31

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53026
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/infiniband/core/verbs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/902063a9fea5f8252df392ade746bc9cfd07a5ae
	https://git.kernel.org/stable/c/d66c1d4178c219b6e7d7a6f714e3e3656faccc36
	https://git.kernel.org/stable/c/362c9489720b31b6aa7491423ba65a4e98aa9838
	https://git.kernel.org/stable/c/43811d07ea64366af8ec9e168c558ec51440c39e
	https://git.kernel.org/stable/c/0afec5e9cea732cb47014655685a2a47fb180c31