[PATCH] RDMA/uverbs: Reject WQ creation without a completion queue

[lirongqing]

From: Li RongQing <lirongqing@xxxxxxxxx>

UVERBS_ATTR_CREATE_WQ_CQ_HANDLE is declared UA_OPTIONAL in the ioctl
method definition, so the mandatory attribute bitmap does not enforce
its presence.  When userspace omits it, uverbs_attr_get_obj() returns
ERR_PTR(-ENOENT) and the handler stores that error pointer into
wq_init_attr.cq without validation.

The bogus cq pointer is then passed to the driver's create_wq callback.
In the mlx5 case, create_rq() calls to_mcq(init_attr->cq) which applies
container_of to the ERR_PTR value, producing a near-NULL pointer.  The
subsequent access in get_rq_ts_format() triggers a kernel NULL pointer
dereference:

  BUG: kernel NULL pointer dereference, address: 0000000000000296
  RIP: 0010:create_rq+0x32/0x550 [mlx5_ib]
  Call Trace:
   mlx5_ib_create_wq+0x14a/0x210 [mlx5_ib]
   ib_uverbs_handler_UVERBS_METHOD_WQ_CREATE+0x1f0/0x320 [ib_uverbs]
   ib_uverbs_run_method+0x296/0x320 [ib_uverbs]
   ib_uverbs_cmd_verbs+0x1a0/0x260 [ib_uverbs]
   ib_uverbs_ioctl+0xa8/0x120 [ib_uverbs]

A WQ without a CQ was never valid; the legacy write path always required
one via uobj_get_obj_read() in ib_uverbs_ex_create_wq().  Add the missing
IS_ERR check on the cq pointer to fail the ioctl early with -ENOENT.

Fixes: ef3bc084a8ed ("IB/uverbs: Introduce create/destroy WQ commands over ioctl")
Signed-off-by: Li RongQing <lirongqing@xxxxxxxxx>
---
 drivers/infiniband/core/uverbs_std_types_wq.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/core/uverbs_std_types_wq.c b/drivers/infiniband/core/uverbs_std_types_wq.c
index 7ded833..0308906 100644
--- a/drivers/infiniband/core/uverbs_std_types_wq.c
+++ b/drivers/infiniband/core/uverbs_std_types_wq.c
@@ -39,6 +39,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_WQ_CREATE)(
 	u64 user_handle;
 	int ret;
 
+	if (IS_ERR(cq))
+		return PTR_ERR(cq);
+
 	ret = uverbs_get_flags32(&wq_init_attr.create_flags, attrs,
 				 UVERBS_ATTR_CREATE_WQ_FLAGS,
 				 IB_UVERBS_WQ_FLAGS_CVLAN_STRIPPING |
-- 
2.9.4