From nobody Sun Feb 8 13:13:15 2026 Received: from mail-oi1-f182.google.com (mail-oi1-f182.google.com [209.85.167.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA6C41A724C for ; Mon, 12 Jan 2026 01:55:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768182918; cv=none; b=M+GtENHEpgUT3cvfZyDv7focNOwAoM1etM+nw3KTPBJLyvcyoutgTMTZErs7tQhgjAZrCggXVQME2m5uNjN1D3pJ6/ucYdtH7hsudyIY5+SSllkDqnYB2AC45+8/ccdUG0IYN3cALWr0O4KuECwxLWQtL/cFT893g1eeopWOneE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768182918; c=relaxed/simple; bh=kCD6HRJcmZrPRPRnBZZYRifzn18q6tmbp9qI98+NNEw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=E694YmTGXItmuVPiDnvjbrVDjKN834ws42HXL7rA1453Ms0kxo4LEBuHAr9nfNOOR0mcajr87/g0/lstFr/GjxbMKYGcMCWn7nmVndUf5PHa+aIPbqr7F6t4K6fC6xAtPc8NMDuU2jbKSmdgcaW+mkCa65hImRYjQXZEkEU8kuo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gWXT466o; arc=none smtp.client-ip=209.85.167.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gWXT466o" Received: by mail-oi1-f182.google.com with SMTP id 5614622812f47-45085a4ab72so3636381b6e.1 for ; Sun, 11 Jan 2026 17:55:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768182916; x=1768787716; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Auu+FpQXOrTqGrm+zeuNScIciQTdgODF3k4zFrtqeoI=; b=gWXT466o9bChFDkjudJZrN4jLrqrM7wsTKVoNPj2Jqbj+st+d5GSiCdNtBCS+a4Uf3 /DmAuuCbgn+a83W34btpxz7b/S1QLMXujCqcTeBZXu4I11a0ct6LmCvGKRw9SPYvh43W ZVFIXxX+w+Il04Z4gHCvFK/VxB1raNVMtLr6hgmxTKUPw5YaUnRWbU1TyTXPYubfs2cg KRgoH8ssM/Ajrs6LYs2WEcEbpgBTdLeTG+qd03IEh0/5kpebJ4mG3tE6V6MDVqx+6pkH pGLYoGdvQ/KcUpJcx7mtWPqZ+Nh4gB0tphRRbBJ96kRpiove12gomIs6qGSDI25dG7ej 0yWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768182916; x=1768787716; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Auu+FpQXOrTqGrm+zeuNScIciQTdgODF3k4zFrtqeoI=; b=M88XaOTOrRj6Ut3DHI29uf3G+L5YntI3Rk57QypXPFCbS+maD88hoP/5Nz4kCR1O9u WNf879+SOHHiwbks1O2fE7mCVQ7N4G5y1WvNLocy932jpbSmriHRRxuTujP0jqHAQXlC qZ1N4lMTPCZDxNEcDu0kEMl2txe/J/FkOasrLe/ZaVNNt/cTa4fvrv3tZfBnRT1+tGxr chr+vqaAiGvj41wd5QWRluw3BrQVKyksbTZox9eJQRLbyDNZ0rs6++yH3lfUMMdulwAo ygxhSMkI2b1vliVhoqgqkDTCG1Yg8bepcRVTvHjvlOpPacm1Eq71WNTMFuXD4XzXd5uH y3sQ== X-Forwarded-Encrypted: i=1; AJvYcCXeq7ZO95tHomKs5VkVxdKMkPG9xP7s6tq5G8Qxjel1AcFe3hrxdftJJdq+qiJ/uhrhyYdZCyze9CjmqPU=@vger.kernel.org X-Gm-Message-State: AOJu0YzZGvU9JRLgfdVyzDEbJEdTgAB+1M1tECqT2t6bBEZ9kVD8qqJk mjBSVW31iu9+EIxzvetkiWuj2w7tmy124NL+/mEkZUf7cByHR/0Ld37XDQzV/w== X-Gm-Gg: AY/fxX5WgdwJFW6hJPepcVbaSZBI3LICeyh8ikt96fptXDQdEWvNbdpMIE8dRf0RJ+X AzZkV7HLC9lpOzt2qWcSsKdWu49SBI+6DpvMe8Mz/+6V8p9W16R91qpDLmwiRsuSFJ+yToTOt1R GAzw1CCaZirRfffW2VCZbyhf7+QSaVYfOoQW4/UMIAxksPe1d5h7qmez1wzVFXJRu+QbXQ7wWHc 8sYw8ujIu6RmOOklL597woKnV8VJgq+Md1DLU4HBqGGKrAoDEYm9FeOdqx7n2eCHEromWLFy/Nj eEpoEFezfqdHwiQAEzh50lDe4vhnTuk9SzAHAiG1HPA2P3KS8f/CUyhvrg3+G1L1sTO1iiMGxu+ qsHHtKUHazVYwsCfB9tYlfNqT18gRn5hAYQqHrXLiLNBQHNyW9aTc6bk5B505299ax990UGnfNg 3D70OvEf0Anb9aPUcs0TI3QCXEoKSkWQCd X-Google-Smtp-Source: AGHT+IE7cs9T4kt1zO+u3pa9BL+SX8PvXlXsEUwB1KxbDesdiOMQ8pOZ2FFqIKczl6ZIqUdd+CQJaA== X-Received: by 2002:a05:6808:138f:b0:44f:6a32:5364 with SMTP id 5614622812f47-45a6bd77d1amr8222796b6e.24.1768182915793; Sun, 11 Jan 2026 17:55:15 -0800 (PST) Received: from newman.cs.purdue.edu ([128.10.127.250]) by smtp.gmail.com with ESMTPSA id 5614622812f47-45a5e183ac3sm7532778b6e.4.2026.01.11.17.55.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Jan 2026 17:55:15 -0800 (PST) From: Jiasheng Jiang To: yanjun.zhu@linux.dev Cc: jgg@ziepe.ca, jiashengjiangcool@gmail.com, leon@kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, zyjzyj2000@gmail.com Subject: [PATCH v2] RDMA/rxe: Fix double free in rxe_srq_from_init Date: Mon, 12 Jan 2026 01:55:13 +0000 Message-Id: <20260112015513.29712-1-jiashengjiangcool@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <721999a4-760f-4c57-84f2-be1753dd8307@linux.dev> References: <721999a4-760f-4c57-84f2-be1753dd8307@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core] Fix this by moving 'srq->rq.queue =3D q' after copy_to_user. Fixes: aae0484e15f0 ("IB/rxe: avoid srq memory leak") Signed-off-by: Jiasheng Jiang --- Changelog: v1 -> v2: 1. Move both 'srq->rq.queue =3D q' and 'init->attr.max_wr =3D srq->rq.max_w= r' after copy_to_user(). 2. Add call trace for better understanding of the issue. --- drivers/infiniband/sw/rxe/rxe_srq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rx= e/rxe_srq.c index 2a234f26ac10..c9a7cd38953d 100644 --- a/drivers/infiniband/sw/rxe/rxe_srq.c +++ b/drivers/infiniband/sw/rxe/rxe_srq.c @@ -77,9 +77,6 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq= *srq, goto err_free; } =20 - srq->rq.queue =3D q; - init->attr.max_wr =3D srq->rq.max_wr; - if (uresp) { if (copy_to_user(&uresp->srq_num, &srq->srq_num, sizeof(uresp->srq_num))) { @@ -88,6 +85,9 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq= *srq, } } =20 + srq->rq.queue =3D q; + init->attr.max_wr =3D srq->rq.max_wr; + return 0; =20 err_free: --=20 2.25.1