From nobody Fri Apr 3 00:00:19 2026 Received: from CH1PR05CU001.outbound.protection.outlook.com (mail-northcentralusazon11010012.outbound.protection.outlook.com [52.101.193.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF1E13559E6; Wed, 25 Mar 2026 19:00:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.193.12 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465263; cv=fail; b=ttZFo+wQgFUkdvxBiQOKUlOxi+G+eZ4e5EVyNThPR9zG9sl/zse8/BNK4jF/bnZVygk1E3T2hqRuV8C40PQSC73s7xSgmijd4BX3MOpgyMCZLYWinpAhI3B8J76gFzlbIzCZZG9ZTnUAerdRgkbje4ECM/8f0yUdBGbnPpitOK0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465263; c=relaxed/simple; bh=6H/CzLHFboiN5aRfvcuHGsDkPb+QLlbXjGJuB4jtRUI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=Xui2juB+I9DtQM9ndERT0vre1KKx3grn06ji7YOC5lpkUeUsSPiUY2Cgxa3iGeGH6pcm/J2ObIFOuapRzIIQdcU7zarblXKIFYqe38ZuX8cXeaYIzinbUDCoBKeWXr/9XQ4F05j3gYJpXn+afQVcP6gJ2TcxJyH5TqpEZlHZuo8= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=J36MnBmZ; arc=fail smtp.client-ip=52.101.193.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="J36MnBmZ" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=hbybrb573GJ8Iwrii7e5nlIAqdgUaBJsezyEOQJg1zn2lu+is/N0hLY8e7V4uTcLoHpwcCS3i/4YyHMkmZt0piy4SzDYpEb0yMh3dU5PUBjDZIQGdLruBe5ru4q1Kw13JKyzS5w6592mi8WBFqzDt7ClI8gdAvQyWQIldoJzhFjiwUk/r70uTvIudxGSE8jQ5XNkyqbSOkBel27iHANW9EiinEJfICD4w5diRoTjHufVFvZjxHcKuQ4Pa45qJBKlDhWj9GIT+mcEHUueMSPwxrfGt5V6NcovV3LLT+BbE3pmm3+kXNn04jc1ZS8qNASUN2m+6wwCQQjiD1w4KaqcEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xwplSS1KMnMSzQ4V5xp4TgLA63kFrlOfesFAYVtgRoc=; b=diyTf/HXakd7qavvQooyHIrsc0M8ip9jnJDAEZC+1NI6i8rKqK9OEZ5+lVEgQaTg9tTf2lTDRkyVFrNOOB5emGdrxYUfO1717fwbnfGzv5gbYksUnqr3p+cTZUcJzi5guoFQuAvHjsXb5MVeWYMA7YkiW7iswS8AYVUYvXqh6YemI+N177IKJa2CNVN6ZmNwtoDOECtcm04E7NxJ447krnogm6PiwzlXBSIch550DpLUr1EkSB39tolC1l93Ra5+Wq/Ph+zM5WtIzOGUv1mM73nSJIv38bDZ3VOE/TcR0ihIIdK/y9Y0w9GjMT9mLA+JY1div6Sa6fvhUcaOPsj4Pg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xwplSS1KMnMSzQ4V5xp4TgLA63kFrlOfesFAYVtgRoc=; b=J36MnBmZIJo3upCa/PUkc5pRwM3oGWDNQnlJxrS7quxz/mnWdd1XqA4Jta3+XSxQXDEQbdzGi+vZbE6rC69PYqxxA3Ggzpj8w0WClt2GNttrL0fzSRj3kar9y5ztGll/n9coVC8flblXD2/oHku6dcGHcWEWE+bSe1GXq3GSIk2l3KdVVygDzYVt0t47H/z/DFBivsg4euVCw7lVFuQZiOU4kkU4u94pBaTs4eLFHR3N65Tp3wg9jAQ0udb5XPPawm2gTaeuu0kKSyLdJDSHIYFi17uvmX6nweUlb3Ag54EgmsJDBsFwhRH0nhKZxFdnkaFPdN4n5G6ERtQCJQufRA== Received: from PH8P220CA0005.NAMP220.PROD.OUTLOOK.COM (2603:10b6:510:345::25) by MN2PR12MB4126.namprd12.prod.outlook.com (2603:10b6:208:199::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.7; Wed, 25 Mar 2026 19:00:52 +0000 Received: from CY4PEPF0000EE33.namprd05.prod.outlook.com (2603:10b6:510:345:cafe::3c) by PH8P220CA0005.outlook.office365.com (2603:10b6:510:345::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Wed, 25 Mar 2026 19:00:46 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by CY4PEPF0000EE33.mail.protection.outlook.com (10.167.242.39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:00:51 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:21 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:21 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:17 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:01 +0200 Subject: [PATCH rdma-next 01/10] RDMA/mlx5: Remove DCT restrack tracking Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-1-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=1983; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=JdRkUYRq0pIWwuMSpYFF7BClsUMppMUSBJcSiThyysk=; b=NdGEFbNpBp7EczzI5ylS8l7mQE+yRWOSQTXBq04xv6Y7yMltwZRRxMk1dZgkbloiMKPD/aLVN /Riu8+mW6rTBAH89xxTYdWmXGnreNg5un9t0gfrN/bEAjx9Jxe/zwHt X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE33:EE_|MN2PR12MB4126:EE_ X-MS-Office365-Filtering-Correlation-Id: a8a23212-81d2-4891-2c6f-08de8aa0d58b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|36860700016|376014|921020|18002099003|56012099003|22082099003; X-Microsoft-Antispam-Message-Info: 1OWf0VlSJlgjrF7+KRlIbKiv06rG7/a0cQsOhqMUR7NNv09ofNd308v/gHVZvRZX1TsPLH/Wx7xckTobMPsvP6JwF0R6MWq6xKgOJI3aM/G+JCqTSfZxCZGUE8/+R1HufgBKK+c7B1J1LdcJjCtH5Sbq+N5QSFoxr0+CjOSOxAszbCMcDyNYk+TJb74Bnc0B4uyDSiIhtH5fMdDQXj+FhAFuVb266DWBA8y2JyQuylSv/Yx2zgw3ff4fnMK0/p9r/88TXmLo5dBmvFEfhBJ6u+1ttWiw1AiE8EUyLgzW/KHqQlbYsrfP7i0yfLyl7Ga6EgcaPTCeKOW6JsZknCsUD4DOycqE7cuHtpDhYHBA9IUoTwBkyaqvU1LyfEcFEw+lxreYBluzLEYpykqd/oZdwhiY7Eqfre1aU1JW9RafI/Boj6+w++Q6ipafzM5mKaonNRJ5otch0KxH7/jSgdNq5Dcb77KXB5HpcIJpPpnRz/Bs2kaqdJxq2qGnxFttAzgibkt0vyfIpzO/5Jkr80JrCD78wJEeHrX2MKfcf/sO20rSiNF+/gRokxhxOgI9NLbf4/HwSqIhMv05PrLh80Ytei5Z/ejeeeQIsbIkJUAVRk4yc/iUHIkaFPcKKdvsCqaDKI36Ey6hV402eagROhQlzSwZl4ohoO8PnxSbcdiGKvM5c2KVMB3S2mJfFu8kjIe9saIG51ZqznJEYfW/JZVEONHOhwXrWWUFxtDzUdb+uIGjp5zvT8WGb+JvivpfSLuuPZAc2YB3SzCImNdyZpqUBLI/f+3DNyBTtEQaKTwxiHUTg8r80biAPrHes0ve50FV X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(36860700016)(376014)(921020)(18002099003)(56012099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 8WmAABdYjN1HNCwAHFtDUBHz7/CAlVgheQRyTu2K3eQiXSjIissi3ZFhNMDbg2VMMDazSEy3WwImeGdGx1Gb6gm4r7Ye7IPBBvlpVkZ72CQofpjw4PzFoUEpVMQh0HGNghKbGVBOPcgnanUhtq5Z7ILLXVNe0QGecBGl0MdWUT2QYVBbV6kVzddcRtTZUNcNZ8hz3a5a8KhScNtZJ7J52WWxzRmRPuaImcGOvwW+78ZaWLidpCL3EeALbtzDkpv3W3nHxF0zRflHybzVmAOoCtXQdfu7F6KzqpVnQornfCsKimC3rjmKz6feEvDDvfY5Bj3rCn803y+eA6/gfXpzpjhcnmybSKzm00cqF/Grwt+ngEoEfhczLzJZDA7TDVRsZQPEe6J/GIw5ADE+YsfdcYWmhNDYlBv+zV1p4vczvgcNwHlY54uWpdBN/wmK1ZR+ X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:00:51.4096 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a8a23212-81d2-4891-2c6f-08de8aa0d58b X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE33.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB4126 From: Patrisious Haddad DCT restrack tracking wasn't working to begin with as it was only tracking the first DCT which was added, since at creation the DCT number isn't yet initialized because the DCT FW object is only created during modify. The following DCT additions were failing silently. Remove DCT tracking so a later patch which WARNS about restrack addition failures doesn't WARN about it. Fixes: fd3af5e21866 ("RDMA/mlx5: Track DCT, DCI and REG_UMR QPs as diver_de= tail resources.") Signed-off-by: Patrisious Haddad Reviewed-by: Chiara Meiohas Signed-off-by: Edward Srouji --- drivers/infiniband/hw/mlx5/qp.c | 1 + drivers/infiniband/hw/mlx5/restrack.c | 3 --- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/q= p.c index 59f9ddb35d4620737980b2bc2179e0a11e6be29f..c54e7655763844b10943e12a704= 31da291c58b8a 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -3110,6 +3110,7 @@ static int create_qp(struct mlx5_ib_dev *dev, struct = ib_pd *pd, =20 switch (qp->type) { case MLX5_IB_QPT_DCT: + rdma_restrack_no_track(&qp->ibqp.res); err =3D create_dct(dev, pd, qp, params); break; case MLX5_IB_QPT_DCI: diff --git a/drivers/infiniband/hw/mlx5/restrack.c b/drivers/infiniband/hw/= mlx5/restrack.c index 67841922c7b8770c86fb5a47588e09560d0004f5..00a9bcb2603f0b094bcef8a4ffe= 6564699a85769 100644 --- a/drivers/infiniband/hw/mlx5/restrack.c +++ b/drivers/infiniband/hw/mlx5/restrack.c @@ -178,9 +178,6 @@ static int fill_res_qp_entry(struct sk_buff *msg, struc= t ib_qp *ibqp) ret =3D nla_put_string(msg, RDMA_NLDEV_ATTR_RES_SUBTYPE, "REG_UMR"); break; - case MLX5_IB_QPT_DCT: - ret =3D nla_put_string(msg, RDMA_NLDEV_ATTR_RES_SUBTYPE, "DCT"); - break; case MLX5_IB_QPT_DCI: ret =3D nla_put_string(msg, RDMA_NLDEV_ATTR_RES_SUBTYPE, "DCI"); break; --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from SN4PR2101CU001.outbound.protection.outlook.com (mail-southcentralusazon11012003.outbound.protection.outlook.com [40.93.195.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 406BA34EEE7; Wed, 25 Mar 2026 19:00:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.195.3 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465260; cv=fail; b=hJ+/BgOuj4jVy++4ZtFttZaGf1rFzHK29fG525PHNCmTNXfZfBRgoiyFbBANp0H7eBstLNJtQB+PgYNzh6VEoFVg4SIpwITogCfJrhEl0WGlqqFYuuG0MZFvsMybsubG8Ea9TX+jgvQQEKjsnwvPAsAbVe5BzkCUuZQZFNhEnSs= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465260; c=relaxed/simple; bh=OCtn3qnFkvcS1A2WnTDmu+NuoqV+KXROwIZrCpgvH0g=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=NsFd02YFuAH2ygY4r0zVsRtYcxyR/5yd9ii3JJBkuHlabiWYPJzfjLeKqnm8A9YtsWu2E7mP9CNxBH5Pf3zPep5Rw1RqjD5zhN9NoHcA1afHZ/ZNIo43wsePUCkuppEH7EumjIyxWFideKzZfMTmW2estzDAarzECHwe1QfNFbo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=EwanVZ/u; arc=fail smtp.client-ip=40.93.195.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="EwanVZ/u" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=baY4icA8QCIfCj8qotmg8wpNQXTYmnNgIgl8aj4+SekAFWVWRDmdsULwo/NkWhr6ZfDk5VzEGdPlF0YhNQRd9ZahBfIaMhGn/P7RccYdJlhb7G5iqxejAWDF8v7dWk6MZuCDOM6NYL2kiGL+/XJqhvMfV4ElWdVEvtG0MVOGRx8vSWAYqbfr9vZxwIgvpWucGQJKJo1oiw54ZFDl2q1Kek6KqL/nljK0RnsCF1qLLdLbB75Ccrt/EJgLp775Dm4Ia537R37NyOBvSX5us4wSZPOk3Q1At5nbRfVkIY2BhODDO3GdjQCRT6YhqfKV+i5R6bhamVJwuXYY7XsYlVVl+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rvC0+BWHcKnZIlg4ICoBk8kNOqzkSfYdpvx/S9m/RZQ=; b=WZrgOnTv3FxWot19DSGOwaNZc95cN0NDrKoOUXnu7gWkc+1ePW6IywLKrhTECLMsrGFMCIHvZ0orFnLvpEpnVf60XDGXaxvpQRoM0S29Kdjsq+kQ7DIwe9DWkMmyUauHXaHBjGDHe4/Ipv43b5rP3r+g10uCOB64k7ly8Rl6FXKztDEc3isYiSFDe4eOp6GaySSKtsy5xUxhd+K5c6aAp9DOHXFtuBO/q0c7EDCartFfCfnAtuKSoksMId5pHw5DCHAiQVlYLMdC2EWpQUEZK+bjZlYZVoLOJGZdx3Qedvs2MyzQ2MQEg8q1jX0lsEfxj/ZeyRjiQKAsqTpUPFEqeg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rvC0+BWHcKnZIlg4ICoBk8kNOqzkSfYdpvx/S9m/RZQ=; b=EwanVZ/uXL+911607LOawfqaHVEVCanAz1qZoKchHRjrs+dre4YukIhu/+Kh/b8WpPQbdnY64X7QRXT2KtRlex8D059Ih0KL1e5+oiVevThHc8JmWHwKACxb7FCwIjLkCNj6NUzCRnNk86gXqCJLEsDPLtRgCtAk0K6FKqOAqYybBqdKiNSJxrPLgB7xV1XICVGYpW2wT81p+FVCmkwoErB11llpMDvreA8v4mkp4jzUAt7q3jkj8LRcSexvopPfyuYk0bKvInAyDqpIJwoEc63tznILEFSwoIce2oPpIq8++sRflaxA8Rh3Gu5L8zCv9Maq731bOvKYJ95dOoZgpA== Received: from PH8PR05CA0018.namprd05.prod.outlook.com (2603:10b6:510:2cc::21) by LV0PR12MB999069.namprd12.prod.outlook.com (2603:10b6:408:32a::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.10; Wed, 25 Mar 2026 19:00:53 +0000 Received: from CY4PEPF0000EE34.namprd05.prod.outlook.com (2603:10b6:510:2cc:cafe::d2) by PH8PR05CA0018.outlook.office365.com (2603:10b6:510:2cc::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9745.22 via Frontend Transport; Wed, 25 Mar 2026 19:00:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by CY4PEPF0000EE34.mail.protection.outlook.com (10.167.242.40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:00:53 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:26 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:26 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:22 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:02 +0200 Subject: [PATCH rdma-next 02/10] RDMA/core: Preserve restrack resource ID on reinsertion Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-2-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=2282; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=gcx/gxokEE4A3sI5jvtz8aq2s339e2gUf/pCqpu6bsY=; b=r8btx+XmVtG0PPen/oKARYWf2LxzSyCj0roOPG9vuZzB9Xo/XQFn3VHiRJHAO1Ir+ZB3P1L9E x/G38RIQQR1Ct07lU+8xD1QJYS4wRN8FwsXFTTcbmtUG9kq78zojYuR X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE34:EE_|LV0PR12MB999069:EE_ X-MS-Office365-Filtering-Correlation-Id: 8f4a3ecc-48e7-4810-c3cf-08de8aa0d6bf X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|36860700016|82310400026|22082099003|921020|56012099003|18002099003; X-Microsoft-Antispam-Message-Info: aGmloHAJttPN8aCLEI7hRacxLBvEcIv5eoNcLaioOGR+DzufqchqQK//9wNsUuBx6WrcelT0fjlyJM79hFuCVl3mB32D3M/xaOj/MhW+V27EsU3a6Xtei9vqEbeE1lFYHphLinVeKGOVlduugGiyWsL65XOp+OL3h5EsPqPUyfchVvPBcdnLqTKgH/WS78gA15fVSUbGsSD3VrPjsS0h2KEKUoG09HRcE6fjCmwoC5QWXRa2P7lf/BzJ2VkX85+S2yCS75cE9Q44qH/DqQwEIyWlddYmPfAL9OsRbxmwYZ5+UaYzqcGFwGWXPkrEyaALckB1USU4/qnG6SI6qsySJX5igaiRzwPudZEMGlMpa+Ruv+/IR3Kf3XDyGtc1wDpEhuq029xBV5almPlz1pHYC1chxH5DJt3kiZ7WnEwx+NTlpG4Uwy0coieF6TG2ZX+ZFsZ0divGIv3BdFpzj2m+sdKfKoJ+Uo8JvK5ejL+u3YC8jNHjo4e9yU/jc/BgC4ZwzJKST1MvMZY/o8xttkkIHLBxi+TmdJKHsVUMPRoUa9xM8Ix8GbNnjZBp0V1tndTxn+IF37dsVmsns5+8z3zSXzbKPcMqAM+oxdPikQ3q4NsFmMxTvBo4dKuNoPvE6r2ySRliTgpeX6JI5fi2dvOdKQfG6uJlZ+5IPox3EZbcWhmOtLPrtRwLrUsfK4vxwHm6Q/js1GMzT1Y3xPO5chIfaSXB5H/KK8sA5ZPYxH2cw60nCYmgRQRyh5o5O5xJUyUrYHAqb1K2xetB9srouoTvfYkQpEAlaV5V07Xb1WoSU0HWNLs+P2a90StbuWqJ2DtY X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(376014)(36860700016)(82310400026)(22082099003)(921020)(56012099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 4mj5VIRxoXWs3pkTOrbFJrXZDFkunbNIGTGQYUZKdj/yUWZKNnY1kBKAiGT0Ohc6cnovcZMCMKeQLKl6J4usK+k9OHPkK65KZyTpBsRDWuHjLeZneiXCEm4lhQdc9HbIhytNAVmxItwyF/RBt7ugoXnc6w44wF378iBqY1fq9dKrhwCblPLNwzNzUb1cYlMXtf2eg+qPI1XWVHprabMCKcpqlDcwOdhLjlpJubFquxTMlFLaM54knsVoDUHX/JMoSjC32sDEjZjeaXrwYkRUFNKyJaI2i80qrVyIciam/0RBUv1W+KoW8AsKj0ngUI0062H+IKAP6XR5AEfVG3wHR72C6C8BPma0qB2cgs0PFGuHYa/P/ziX+t0lFl7od70lToNaX2nAoblWFb60bVXm86vCg9J+18xhRhY1IfZcqKyqknakLQ8IJXmzrGQJkbGU X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:00:53.4722 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8f4a3ecc-48e7-4810-c3cf-08de8aa0d6bf X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE34.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV0PR12MB999069 From: Patrisious Haddad rdma_restrack_add() currently always allocates a new ID via xa_alloc_cyclic(), regardless of whether res->id is already set. This change makes sure that the object=E2=80=99s ID remains the same across removal and reinsertion to restrack. This is a preparatory change for subsequent patches in the series which will do rdma restrack removal and reinsertion. Signed-off-by: Patrisious Haddad Signed-off-by: Edward Srouji --- drivers/infiniband/core/restrack.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/r= estrack.c index ac3688952cabbff1ebb899bacb78421f2515231b..485e7357c90a5ff9660feac38a0= ec01c0deb0000 100644 --- a/drivers/infiniband/core/restrack.c +++ b/drivers/infiniband/core/restrack.c @@ -32,7 +32,7 @@ int rdma_restrack_init(struct ib_device *dev) rt =3D dev->res; =20 for (i =3D 0; i < RDMA_RESTRACK_MAX; i++) - xa_init_flags(&rt[i].xa, XA_FLAGS_ALLOC); + xa_init_flags(&rt[i].xa, XA_FLAGS_ALLOC1); =20 return 0; } @@ -71,6 +71,8 @@ int rdma_restrack_count(struct ib_device *dev, enum rdma_= restrack_type type, =20 xa_lock(&rt->xa); xas_for_each(&xas, e, U32_MAX) { + if (xa_is_zero(e)) + continue; if (xa_get_mark(&rt->xa, e->id, RESTRACK_DD) && !show_details) continue; cnt++; @@ -216,14 +218,24 @@ void rdma_restrack_add(struct rdma_restrack_entry *re= s) ret =3D xa_insert(&rt->xa, counter->id, res, GFP_KERNEL); res->id =3D ret ? 0 : counter->id; } else { - ret =3D xa_alloc_cyclic(&rt->xa, &res->id, res, xa_limit_32b, - &rt->next_id, GFP_KERNEL); - ret =3D (ret < 0) ? ret : 0; + /* If res->id is valid, try to reinsert at res->id index in + * order to maintain the same id in case of a reinsertion. + */ + if (res->id) { + ret =3D xa_insert(&rt->xa, res->id, res, GFP_KERNEL); + } else { + ret =3D xa_alloc_cyclic(&rt->xa, &res->id, res, + xa_limit_32b, &rt->next_id, + GFP_KERNEL); + ret =3D (ret < 0) ? ret : 0; + } } =20 out: if (!ret) res->valid =3D true; + else + WARN_ONCE(true, "Failed to insert restrack entry at res->id %u", res->id= ); } EXPORT_SYMBOL(rdma_restrack_add); =20 --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013042.outbound.protection.outlook.com [40.93.196.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A76C350A33; Wed, 25 Mar 2026 19:01:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.42 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465268; cv=fail; b=S1D9sYtM1xBabWvc9b/ovDxS/+NaUqZSEnoUHPTsUuMEbRbt0t/ll9vFDgOd3ioha8oJ8gLL8SvOPt81JiMlQr6ZcObqnaet7TDMxrawpV3AJrIsCK5CuFfKBo6NMpkSd6BCey4HxD7l+AM0jTWJNDY78g76EJChho+Ro7kaIVY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465268; c=relaxed/simple; bh=grM+h8GRDnOD4JjfMVxqh7PYok2VkVzxVMjVCs+8eHA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=cwv4ZMDre1pv2phtyDeif4Xg/YHOEfExIdL3z+9Bll3XfRGDXA33srjaTlAheiYu58AX/ll3lVIwxvMLaPS620sTsja4JGZFoogrH7bmtzOnmLFYEs0cfnY+EcyPOW1dVB9yf4OHhyjVDl3Jlxzt9bpvbyeTHfnqGwjAiZ5APYg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=Oi3B3QZq; arc=fail smtp.client-ip=40.93.196.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="Oi3B3QZq" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NnLMaYWfBeqqOtwD94S+fNDHSEB4o9hTlw0c9xwJtkKyS2e8F/7xAp4lvy5SIK3x/OvEsILyxFC1XmLwWJWChlUCszeRyNQHQxG+DKmxxJ0lsFkubEo2CavcDRrc4zu8chDBci9G99KkX5zA/9BCsbifu3y1OLxyWsi2hM4VO8huJjTff/b6zmfBxRSXIP1yGzyAnE9ubtKQS0TIJIzxVnSXcJHk9kL7NLz15t16u88EWUn4G6D5gP1i2/0QaJV7rrpV54lQ6+pF5T1/fRY49dvkaiN+0/lVYhqx/n6yJdvmXqoMX2CmvKadr3jECwV6crcbxLUIYWpRUqwl89jmMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=h8GRjYq//0NzG23dOsTx8zq9q1wRwikt2KBwkuzABrY=; b=a+3BEA9gxi1xn8P0LXhNeWfIrbGK30ASKBWiSYR2zbaxytAuKoFL1pbuLg+xleQLyGJFiEVGOMldOHf828V0rZmsd42ark/BTXkbYy1aFv+AnwsjeW/EyVqZxfH+SjTZFX23KqH5LQwKSrr5MKkFfBOdHbZ3EAARRFU/l8A/uFJT9/MXI9MGHyetLurv7Mu6d/nLznCY7CpJLR7uF3HdqZEjAepCTMOI5CBJuTNbpwhBkzl8hds90ujfOcRmu1swt22kC5AQ5a0Fm2fuTD79290nAifNy9DLTKsmd2TkrxdwpjTy6iB2qq9gNo5UXuEJXwuFlETbPTQrlBkkQ4t/RQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=h8GRjYq//0NzG23dOsTx8zq9q1wRwikt2KBwkuzABrY=; b=Oi3B3QZqSz0RGFA4xBIl67zPCLBwx2rHomjc5bg5rpB6NGolChv54qvRgMRCU3IVfnaEDhc2Z8ynaTRhar+EJXAgCctdnt8+uU9mfNIzbS+SKeNMFAZ2Bvl2J2bD0G8PacWJKjGrhsumBEHoT0NaKLL8K42go4o4+r/s9mFtfDfiokLqOenmxfjdB4awUXCwvDn9hwhjddIuyRqxDqyw5HU3phhm5/gNCeujeJFGtdIAAOcG7iUVFV4cNHkAa9/IYvN/6chzwIzSxiKPpFXHWBUZOCFE3RAdTaJFL9cgUu1vn+VT7CIjKQo7OVhjqH2qlog76Zdj8HGDKAIgCPjtHA== Received: from DS7PR03CA0330.namprd03.prod.outlook.com (2603:10b6:8:2b::22) by MN0PR12MB6003.namprd12.prod.outlook.com (2603:10b6:208:37f::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.7; Wed, 25 Mar 2026 19:01:00 +0000 Received: from CY4PEPF0000EE32.namprd05.prod.outlook.com (2603:10b6:8:2b:cafe::46) by DS7PR03CA0330.outlook.office365.com (2603:10b6:8:2b::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Wed, 25 Mar 2026 19:00:55 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by CY4PEPF0000EE32.mail.protection.outlook.com (10.167.242.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:00:57 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:31 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:31 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:26 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:03 +0200 Subject: [PATCH rdma-next 03/10] RDMA/core: Fix use after free in ib_query_qp() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-3-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Michael Guralnik X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=4118; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=2El8cr+cyAa9RBhRtC46e0TzQiWJ1QGucPstWX5Wtd4=; b=t+JGnpgbSJ3u8n4OtaoroMWZ05XiB76/I/I3/EoCcyIOvMDNQ8gEsKsuMdxGOFq8S2WIzkkh9 6UdiDrny9ofBRjp+oyHRTzofEQFrhHq1rwPxVWyojYHoMe7KjEEW+wz X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE32:EE_|MN0PR12MB6003:EE_ X-MS-Office365-Filtering-Correlation-Id: 1536fea2-0a61-4945-e126-08de8aa0d961 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|36860700016|376014|921020|22082099003|56012099003|18002099003; X-Microsoft-Antispam-Message-Info: c2akQPeSQkMK6oDrQTl6KkLcAqOpJ5XHR28+ErNqPvwErQB/+E035xHxFzJiwstU//Ost48xu6weZ59SlqCI3JT3nM58+acXXcXb3RmWf5MRn2PkEfZxAAJAXoO/sJZ6xHqUmzoMwnHRIgC0CrVWRPgR7O8dPcLV6Qp3wmItcByHU5CxVCqxjl/bIhWXn1d24T4WUKi2HV6EKGc7/5ko9bcz/wWi3vD4Iw2T5iRqc1TNdPyfNktdLR6QLDvEb0gIGlF2RIao3SZKqXxLvSr5YzPI8q+3S46RglU+2GXv1t/fSSUoO80+w8/xww/N+PzxTolPGvJmEofZritf8ht1PmoP3jmV2hguSzuke13iTMHqTDmPh+2XwvYTEzB1IL3wkDhVooo/W6VgtgxaMXN1dsQkzTgNIkB3EXpnR+RjBa/kwpYKF/aKWeJICrnobVXvukfhdbmegk0oruwuUnMr9NqpqkPHy0m/42CV/P0DSxvEhQyyhYWjY0nMpCNJcuJ9HTzbupB9HV3h72nu79HwBrEWXnEF6JBTn1J0eHw9QOc1vE4kqNjTYmPWrTa08eSpQO8JGGrIheNFw6MDZDzUbA4Xj5Sr3AJn9LBROjtHxVpGMsiFaiAMsOKfpcrprFWp+MuMBWTr7Qf00WhyBSBJa9JE+KV9MGWrMwI1SwrCyRh036SIusMJMZMCDBiW1c7A9E+PqFUOQXoNeqqjvqm10sk88rd5ESiCx9k/rqdyNky8iEBGw4LiBk+wEVskW3sJ2xRbjblTB5CMw0wsKZ2nNKPwgGVZl8sl6qcHrUDlUXAq9wc/zlv7StFcAJkVpUJw X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(36860700016)(376014)(921020)(22082099003)(56012099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: k0VBFJ8BF1HagL0WXgcp4D4zohizFUzke0GbJSZ0MSsexPoL6H0OEXya6K4OovP+z29b8gTx5C4YrKfVl6h2Pi5jZKeMo5WXPjkwwYemuoIgTHjKDyaDztwOjsDlnfQlv8OgOGT0etFtE1DmyO9O2mLZkdF7iDBmpyNJ6aqVJZlJxn8eVkjobtwPq7Kn+XUlX1fPMhOB6FCHbapfRhWHlpsikfnKyASAPw6KBwmKvptgbrNeOe8prk7EUqPXz3qGLZzDIW00P+y4alBMc5F3pOvV2pvyZ7uLnHNSW0H7hFRiDJI9IhrZJTwNlwguEmb2jRX/ZuBtYlMhnIcqEEljrRfTRREPVW4t7zPxuMev6mjnDb0HOOsfKWUNMG8W9FEKTf0lh6M54yUmS+olF4LmJaKT1Fw3nD6vujgjGs5IqAF1xfgh1RqjZTPBXCdXmbpR X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:00:57.8337 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 1536fea2-0a61-4945-e126-08de8aa0d961 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE32.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR12MB6003 From: Patrisious Haddad When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdma_restrack_get(), meanwhile during the QP destroy path rdma_restrack_del() is called at the end of the ib_destroy_qp_user() function which is too late, since by then the vendor-specific resources for said QP would already be destroyed, and until the rdma_restrack_del() is called this QP can still be accessed, which could cause the use after free below. Fix this by moving the rdma_restrack_del() to the start of the ib_destroy_qp_user(), which in turn waits for all usages of the QP to be done, then removes it from the database to prevent access to it while it is being destroyed. RIP: 0010:ib_query_qp+0x15/0x50 [ib_core] Code: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f = 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 8= 0 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff RSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370 RDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000 RBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004 R10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370 R13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c FS: 00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0 Call Trace: mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib] mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib] ib_query_qp+0x35/0x50 [ib_core] fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core] ? __wake_up+0x40/0x50 ? netlink_broadcast_filtered+0x15a/0x550 ? kobject_uevent_env+0x562/0x710 ? ep_poll_callback+0x242/0x270 ? __nla_put+0xc/0x20 ? nla_put+0x28/0x40 ? nla_put_string+0x2e/0x40 [ib_core] fill_res_qp_entry+0x138/0x190 [ib_core] res_get_common_dumpit+0x4a5/0x800 [ib_core] ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core] nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core] netlink_dump+0x16f/0x450 __netlink_dump_start+0x1ce/0x2e0 rdma_nl_rcv_msg+0x1d3/0x330 [ib_core] ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core] rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core] rdma_nl_rcv+0x12/0x20 [ib_core] netlink_unicast+0x255/0x380 ? __alloc_skb+0xfa/0x1e0 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x230 ? copy_msghdr_from_user+0xea/0x170 ___sys_sendmsg+0x7c/0xb0 ? __futex_wait+0x95/0xf0 ? __futex_wake_mark+0x40/0x40 ? futex_wait+0x67/0x100 ? futex_wake+0xac/0x1b0 __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xb90 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/verbs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index bac87de9cc6735c5d25420a7fac8facdd77d5f09..f1438d5802a3e97e22cdb607cf9= 0a097d041a162 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -2157,6 +2157,8 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_ud= ata *udata) if (qp->real_qp !=3D qp) return __ib_destroy_shared_qp(qp); =20 + rdma_restrack_del(&qp->res); + sec =3D qp->qp_sec; if (sec) ib_destroy_qp_security_begin(sec); @@ -2169,6 +2171,8 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_ud= ata *udata) if (ret) { if (sec) ib_destroy_qp_security_abort(sec); + rdma_restrack_new(&qp->res, RDMA_RESTRACK_QP); + rdma_restrack_add(&qp->res); return ret; } =20 @@ -2181,7 +2185,6 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_ud= ata *udata) if (sec) ib_destroy_qp_security_end(sec); =20 - rdma_restrack_del(&qp->res); kfree(qp); return ret; } --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from SN4PR0501CU005.outbound.protection.outlook.com (mail-southcentralusazon11011016.outbound.protection.outlook.com [40.93.194.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 67C853559C4; Wed, 25 Mar 2026 19:01:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.194.16 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465276; cv=fail; b=qdSX8l4shwHmxB+g7yjeu0+SqhMBPzhc17VTbviDzUm1Uv+KC8AlvrUWA9dfz4eMc2JMzgznrLJ9yhtBcT6SSi8s5/kwHwlp5FPtcQ/VHPCUc0hXMohOlbBhl4nmBQVzXWTxC3nN+PpmOflki0MNsjQ7hGffpD+mjcKW8pV5ya0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465276; c=relaxed/simple; bh=mlYGaSGcypbRrSzsVJd5s6J5OjBBc/13GebHEXUJi2k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=loYx3+Ae1D6eZSvrakbzIPjSUAgmzUkufldiLnvqWkKelCk/4V+C+7roeJu1u7wV9ZcEZcIIB7Ze8SaEg1jk18nqW0FUlrRipNLmwjThoR0CZmfV7RoYpOtpX9aQxIzIdBGmGkgnw7BcbdmzOam2x9gCdDfkfYlA1aG+q27kX0Q= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=hy4jtLmJ; arc=fail smtp.client-ip=40.93.194.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="hy4jtLmJ" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dxhsHLPiaoofZ+9ASiuiYYzluNvX60kip0WQBpjgRupI+hg+raz8sl/WQkCTid7m6useNdl1NqtMdPo1KHyGgIaoFLGucKuGUPe24Nsf47zSr5+aaNpDaZY5lc6ziteU8ggAcMheBP72YVD0/O7OE77mJxdSbvo2FmiCJdORDas1BYFT9zLAi1QkoIY2hIPHQJlIODmFRAniGrquvymIrwlAWhqQZ0zFgEAmBOz35r1zjz2WvBji7TQTZNgzFihT+uWE6DHfKOrEmCEvFetZGF4Tbbaxf0nRA0/rfcK9mVUF4V+DwLlrwqTjuUne8QTg3TfHzPKq38aIDD90NjqZ/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=aU/5ZDly+FSYMwDs7YwvDW1Y5j8zd67Xk+OGoPFhI1A=; b=Jir+RS/ZuXfeDhPPJuQnaemaKlzl1UXtB7qjbR4VvzaBNQhZtvWFYiAw9tUaG55uxrgpbH9XybIQiZ5Fv02vUr5EsMRycQRFp0Aihd6OwsB4s1sgbjjBtdQlk9yKQVmDUDJIWHIlUEzrzgaNvXrvgBqjHEGooZHrMX15eM4nsK9gFcmziUb1l6r504rD9NwXTG4ZM7sk6QNKfohIHZmrnp5Kbrv6ougEUcdDGAsmNPoaW2qoUCcT0q81jCjf8jwxxAvI/0A6HOH2vMXvN5y2J46ylKIGchIgCnjZUsIWOEFzw3xWbiQwm+6MMvibcQ4SsJDS74KpFIfmYRCl+Mjmww== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aU/5ZDly+FSYMwDs7YwvDW1Y5j8zd67Xk+OGoPFhI1A=; b=hy4jtLmJ/jwTGCvb3MgGF8vu345g6NakTHXsRd2du5EAoFcECJlZsiI2MwfZWQORlFawY9+SZ5kCbiLGtEA2mwUkQiv6B2ke5/i1ikOkj1nFzGzcUFwnGzH/wi8KBz4NxzBumCErTjt/arsw1VhxLvVzRUewh9OaKYKedEbJrnSQiZqphavFby0o0/dmNt1uomZRjZPtWluekVvUNeBGfrwchrTligmJeNvAvLYyuIrYIuzZLr5K3cVjr2liT00rLBvnhY0EmlK2iC3kZ2FQoARr9LEAvO4svtLrQmGFzZZ7nxgMAZtYNZ9uye34YkTvSMWxZt50fCkoO9NTlQgIsQ== Received: from PH8P220CA0005.NAMP220.PROD.OUTLOOK.COM (2603:10b6:510:345::25) by MN2PR12MB4224.namprd12.prod.outlook.com (2603:10b6:208:1dd::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.20; Wed, 25 Mar 2026 19:01:03 +0000 Received: from CY4PEPF0000EE33.namprd05.prod.outlook.com (2603:10b6:510:345:cafe::93) by PH8P220CA0005.outlook.office365.com (2603:10b6:510:345::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Wed, 25 Mar 2026 19:00:57 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by CY4PEPF0000EE33.mail.protection.outlook.com (10.167.242.39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:01:03 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:36 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:36 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:31 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:04 +0200 Subject: [PATCH rdma-next 04/10] RDMA/core: Fix potential use after free in ib_destroy_cq_user() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-4-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Michael Guralnik X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=2124; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=W/2WlJLn689ImNNVXH7wlhyztcjmNw/q/99rPLeorOI=; b=dNzHZd6qmvrjv6rZIVVQMzOkh62HvcNJFGNLmw58dlWUjAgNwMNM/fKOd70F4TcsbKE3DQ66o 0eg5T8Q72muAywgFDP7I7BqI5JlWfaPE2Uo6fvITi7+RZ0NmgV/ES5Y X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE33:EE_|MN2PR12MB4224:EE_ X-MS-Office365-Filtering-Correlation-Id: 65d15659-b409-4e15-fd7e-08de8aa0dc92 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|376014|36860700016|921020|18002099003|22082099003|56012099003; X-Microsoft-Antispam-Message-Info: 9U8f4Dybf8DH1Cu5A4xee4e6kfnh1kBM9sjHw0RJBEUfFicrJxPex8kqPzFhQK49dykupOzem0hnKWoeGM7NQ+YZVCV04pSpgEQTq/bXvDtBsRVKb3TI08eiCooyQG0qi43SqWwQGQp2XkvUDusD8LHAIkNuzuNwDps+En/Ou7LZKoTHMomhCdwnsvF0sDFt/U6jGUCRTidbzt7GPHfxfqJSoOZtM/Vc2G/UTK+ZvEnAYGpoivwm5Y/RP8x9in0AnRuXx9E3fJPleD6BJcpzfMnxbLtc05AezGv2kJAIKANbqw7yslJWoNnqhqwY2VlxrlSHnY4ouBPH2/ldiuocbIva6PMM0lU86Q/FrtMlGkNnf6a2Ql36N1LIo4Kog+o6wwCNTgERHIReZdHrPpUEMNLgDJJrZZ5eCwd0SiIfO+AMXKDE5h/DcN1xwfFsU9uprtqXcdcfmaD5sggkFEfYuZfbpbhOVzJFgggbu0EyTQKTKfiS5kI/kXROSoXVnnBgOOn15Q+4YMEjMS3e9cQPRKDYSfvtlnxDwC3iqyT8/2j772pWf3Dw4OiOt57l/i63rsvfeXTTutTedZLY5oxJMhSOOtJubAcjx054d1+AsFIQiSNLWJATajh2mTCoG7c7yjj7bdgUSgVNid2k26O6JhBtz4UVvybeEI52CjF0op3rkR9yrOJyBk5MTiVTP0cquyl0DnFTZD81/xGkGdly9wNiGiN6kvwoiBPpU/8ZgIHOX4aGagZ5Uo5/Vz/LsQwr5/3F/WLk+J/HrgqWgBJs72hB6kKiG3n3nSbeWDMr/i0vWuMnlr6XL3ozbRbDRpOe X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(376014)(36860700016)(921020)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Y+rfFUCmDojN5ss+K97QHhf3IDLkVfI3eVJNJFEEEm/Uwp/kECMfufV4Tlt1FmeoCb9smu9FXnkajgjnPXArXuosCHxHeN3lEQaznmzNoqQnWDfsOoYRDw6yDjcCTVjRFMidqHurTs1JqJrP9VUnngcT9Opp0OCM1NTKSyLrfck26h3mObCQAM1NKzEvTfHLBh4XucN3q4ZDt834H257cB1r6QcUMYK0VGaODsCUk2sn0FsCD13b8hxRXVUhYHmY9WBBXixcMJwDiwrqmc462qBEwqxswPU5PZ7g3GHdKuEq7X8eEulV8XHHlRwuTQb52yf1Dob48//n2HuUbosAFJwasnvoTRZ9cwJldUQ6DnQF7vsPZfQf0ITrQmQsy52PpT6sfwAxR2so8wxLMA8BnJldbbOsDTfqigVRMwcPMcI3uyQ3htrqdIvG9cTW5IBW X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:01:03.2513 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 65d15659-b409-4e15-fd7e-08de8aa0dc92 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE33.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB4224 From: Patrisious Haddad When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_cq_user(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to the start of ib_destroy_cq_user(), ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction. In addition, this change preserves the intended asymmetric behavior between create and destroy routines: resources are added to the restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable. Fixes: 08f294a1524b ("RDMA/core: Add resource tracking for create and destr= oy CQs") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index f1438d5802a3e97e22cdb607cf90a097d041a162..0e8f99807c7c0ce063ed0c1561f= 4ba42b485b69d 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -2256,12 +2256,16 @@ int ib_destroy_cq_user(struct ib_cq *cq, struct ib_= udata *udata) if (atomic_read(&cq->usecnt)) return -EBUSY; =20 + rdma_restrack_del(&cq->res); + ret =3D cq->device->ops.destroy_cq(cq, udata); - if (ret) + if (ret) { + rdma_restrack_new(&cq->res, RDMA_RESTRACK_CQ); + rdma_restrack_add(&cq->res); return ret; + } =20 ib_umem_release(cq->umem); - rdma_restrack_del(&cq->res); kfree(cq); return ret; } --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from CH4PR04CU002.outbound.protection.outlook.com (mail-northcentralusazon11013050.outbound.protection.outlook.com [40.107.201.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 076C53F99E4; Wed, 25 Mar 2026 19:01:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.201.50 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465278; cv=fail; b=Ku6G0g40wN8L2Hn3VJ3QW1R0XzmUeAwCzC10cANcxdPswOELVKOXAPtO+tBAd7vz0/VBYngD3Ziz6YxtvFuWZmEIsZkz3Q0GP0muRKNQs4LioLVY3JaT0/e0V/6f5tJls4E/LwHRRIUIKu/3J8bW73TiNQWXvrck5jxOPzYwXlw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465278; c=relaxed/simple; bh=07Ei7A7KKyx/vqJR7s+8ixUlAzuruB+Ehpyaj86Sa98=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=OaYt202iHq05pfRaVqOoyppHqn7VSJcLOL+0CuMIJHA1oXeRSP62otsGFe1jZjgO+amf4m9y9PRRBRSSUroeyNdI+PKOe2/gMCOiIgSAxCWaYC1IMx0XkJ14GstdSIUVGSQdVh9PZhjNpQkmmsAaxkqcKuXwUkWh3MUrjqGz7D8= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=N3Jeo/e2; arc=fail smtp.client-ip=40.107.201.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="N3Jeo/e2" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ovBHkqEFk5G8jSnmtUF7OR3fY6pGcJB2/hrwQFz2LI1C7xzifZ5hg5C2+X21R2hOTF/OKgil8TBo/yZYA88yqO/0isLN93ktsewLwh4a/O50qpEMaTagAuKDrqK3HODLUz9BHr7ldYeQJXPFEOutMCN9v77jaY0zq2Ab5ZrrY7hkvOn2x0kN620slFqqx74+s/UioDbpEFxdOk3Pd7+F8An1Qlt9C+ITobYaR/x63RsemmvoxMhNIMzP7aKgN0zM6U6VDzqqlI2VIa2Pp8B0U4T9zIad0dWtZc5o8ic+oRc6NL+uD0T3MO/TutOIcAeQDnylJqkvmw+osV4NTnMCCA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EtLo7npB8ML4O/w113KywGQ7UkDxwFA/f1k6Bqj39vs=; b=gvj0TOuB0Ergb/DFj+agX0QwtNx1X26QGzYYhn7mzHHFHdE1vaSVzW7wjf6lp/TnFfsfxS4Ma1WtWOqg5B6sAA/0UDcmJrZRQvvbJ/6vdbvc6mWON1ImoZfOWo1gh/9IwsLyKqMISJL+8WsZk5/XjIjRVMIXv5kRbcwFwpy4G7+xoZjJDX/3+zUSM5MTGDeBa4AlnzIaeIbi7bcFj2Zti8QztbHNx548aNioJAtXSnLjavfeFNwXVru4jfdFWzlKp9DyLkJ5aAZvHJ+C5JjlTeS4v/r0YwruH3TbVGXIfZoXD3tlw9CDqhp75TaVlquZXW5gPy9h3GJFXvWDklgJBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EtLo7npB8ML4O/w113KywGQ7UkDxwFA/f1k6Bqj39vs=; b=N3Jeo/e2gNkPXDO/jr45y7geK2Jlbye3dmHY7EVmdYmrhdqPSOqCipMr4isYHmBJWPp8qj4bL5Z4ItkTxGGfUQMfFibiOaCqWkv+3Im44CiHIkDQuY62VrDP8eVghbwiN7yuYTt7X8XVtzI0vdQnapOmtV7wTcSfX+Fg9T639eToQyFv+urdNDJcZjK3T79DYfscSWocd01SxVhrrg+AXF1c72DcIEmy9kOdVYkaat0dzA4uTSWFbisFIW04awiYcTkMHlvw9n+ZwacpOcq+faCFvGcXb0XG7BU+jUi7CwaV8hco2VL920MUvFHixsGdpaavbxCmtOOGMGPG6HKiXQ== Received: from DSZP220CA0008.NAMP220.PROD.OUTLOOK.COM (2603:10b6:5:280::9) by IA1PR12MB6066.namprd12.prod.outlook.com (2603:10b6:208:3ee::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21; Wed, 25 Mar 2026 19:01:12 +0000 Received: from DS1PEPF0001708E.namprd03.prod.outlook.com (2603:10b6:5:280:cafe::59) by DSZP220CA0008.outlook.office365.com (2603:10b6:5:280::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Wed, 25 Mar 2026 19:01:11 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by DS1PEPF0001708E.mail.protection.outlook.com (10.167.17.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:01:06 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:41 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:40 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:36 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:05 +0200 Subject: [PATCH rdma-next 05/10] RDMA/core: Fix potential use after free in ib_destroy_srq_user() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-5-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Michael Guralnik X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=2320; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=+VtBN5/ICOt22ljghD3KcEb67UyEfMhhKiqtiu5cMQY=; b=1edRBtXzudf+3d85XfQrU0qi78uqAjREt2MpPaKIM9JBtttPz51dtZiRyKTVdH//YM+o6FIye QcxPMrBrNhgDoR4kTdhylq/wyIR+Lz8LUhJ6ykxGfLgkwfEUqjmp/DP X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS1PEPF0001708E:EE_|IA1PR12MB6066:EE_ X-MS-Office365-Filtering-Correlation-Id: bf17f7aa-de32-4ba8-b849-08de8aa0deb4 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|1800799024|376014|82310400026|921020|22082099003|18002099003|56012099003; X-Microsoft-Antispam-Message-Info: ngbQ+3adwyxJl2tjTMkex9u9c4z3yiyIfnGf+7nW5EHbqeMtTEp9sK86OtNhgcR3Lbpqc6BTqRUku+YOk7rQZvdSd3TnfvEj37mMEwP8vcY/45aDtFOfAlU9aWg2Ffcarp2fdFFFjoqaxeqSCugw9rnS1b41gNwz8Xuaw94IfV2Hgzc2O89CINNStdp5U/R9d9PFlCenpy8NWcpnPzIIlSjpTWHJykVDcwUxIcBGsajgJbmzQYHZXrfsK3Q0rMMgggsT1CG80ZQXUHz3N0UZyyS8U7uR+ThAfkEefgKodIQJohqHQZFFoczNs//6j0A+asH2PHR2JppPnlnUnroDpw8yCbFV73LNRursHpBXA9aRVMfuYrziEQEDyU3/1V43D3HeMMXKoW3pwCtc3OclfJxUhtZCvgfpZVVwqbDc6v8bQ0PtKB2858WoFkxwRrKkxnvYSKUHEtLOET3Diw6X9ia2NB2L4gZODJjJJq3fLGVU8z3WPeQqLUmjuUj0wMlPUZk2G1w6+gZlNpIJLBb8Gw2uBcdZem10UxGT/Qygm2I9KTTCFeuc7LqKk8JS03uF4yrAzyV+a78c6JT1hvXUCLBOzF6eeIseQ3MUfchyDU4SF4L11js1HI934O2k7ffBZqh2fP3jZY8IG4I0vAy49j7npr1Weu5o+t+b5JQSgr8PrSxVvt8Y/mhA3fZRQUpZ8an3dby2QMyog+GA3afuEyiTqLi0AvM6SFz11US2wKTVEKZFR54d8BN1orMx6RzUOuLfzBxax04Ujj3RcORvEl2b8AyVbOj3SfmClSg/7/Ii+3VENTp3hTMSWIytKrTQ X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(1800799024)(376014)(82310400026)(921020)(22082099003)(18002099003)(56012099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: H0df5UcQAPiRGkJrd2glf11FGtX4WzytL+oi0G+SH8nZktSblsuuGlXC2YXtle75GnQ9mX7JiiDEUSg3v1B0zkhnivNzsxVeuGGHTVWszXVVMR03u2z+c/pIGdW4zt4z+8H1nyaQzOCQ8PzfomGukDsTdtfftaVEczC426PfTor4C7P4uaj9LL/OSFGt2cgtW8tofa3GmlKIHotQPU1oPkYFjvCoU3GXOFh3FnN4nX0nPYdAtvkYgBjxYIcT5NpDBedmVBknNcqRxC/ZhPq8z6FwipSzb6LngOU9ahXCWWdEvssyYZaZC6Ps438tCE80JHmAgOi9cq2dIdWs70NzcM/ZSPOMuaojS8LrqfVeg3LSFt/JyCqCgZ/8UzSzTtd6v97BvEZ4UpVsJMQ5RkA59FR8dX2NlvAZi2j/ok7K2PkTQWIq9CDMc518S5YD1nOg X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:01:06.7682 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: bf17f7aa-de32-4ba8-b849-08de8aa0deb4 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DS1PEPF0001708E.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR12MB6066 From: Patrisious Haddad When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_srq_user(), which is too late, since by that point vendor-specific resources associated with the SRQ might already be freed. This can leave a short window where the SRQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to the start of ib_destroy_srq_user(), ensuring that the SRQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a SRQ that is in the process of destruction. In addition, this change preserves the intended asymmetric behavior between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable. Fixes: 48f8a70e899f ("RDMA/restrack: Add support to get resource tracking f= or SRQ") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index 0e8f99807c7c0ce063ed0c1561f4ba42b485b69d..5921c6d008bb10bcce5f3b9bcc9= 9de72193941db 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -1139,16 +1139,20 @@ int ib_destroy_srq_user(struct ib_srq *srq, struct = ib_udata *udata) if (atomic_read(&srq->usecnt)) return -EBUSY; =20 + rdma_restrack_del(&srq->res); + ret =3D srq->device->ops.destroy_srq(srq, udata); - if (ret) + if (ret) { + rdma_restrack_new(&srq->res, RDMA_RESTRACK_SRQ); + rdma_restrack_add(&srq->res); return ret; + } =20 atomic_dec(&srq->pd->usecnt); if (srq->srq_type =3D=3D IB_SRQT_XRC && srq->ext.xrc.xrcd) atomic_dec(&srq->ext.xrc.xrcd->usecnt); if (ib_srq_has_cq(srq->srq_type)) atomic_dec(&srq->ext.cq->usecnt); - rdma_restrack_del(&srq->res); kfree(srq); =20 return ret; --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from CO1PR03CU002.outbound.protection.outlook.com (mail-westus2azon11010025.outbound.protection.outlook.com [52.101.46.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C3A63EC2F2; Wed, 25 Mar 2026 19:01:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.46.25 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465274; cv=fail; b=jQaqldisy9OdfXtAdR2BU3vhTaahSjoRgpmXAbvGqaGaXhIc9iGRVtURHF+Nrg2mhag6EpP6s/F2tqa5pWAmaKa9XdDExZlYDi+059NAEb7FRTdj6tOxAh2yzuT1hvgAvJ9Pb3WKMV20jd7mgGsY3SRRahpkts9m4RCfax2zX+4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465274; c=relaxed/simple; bh=jG4K3gWAL+oCtETuW+eR6WjLnBjgrjVn5MCcyIZ2jJY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=DX5JqXPnEqfeF6Pn2teZw9/4jxCRepty2pC7Utnv2Zdhrwq0TTW5/yuoOpLuegYmlBzX0ecCPjd/PZhhHqGwaeIkN08PuF4/J621Z+2LivQTiIKFe3P3o6sbWOftvY2vGq02JJJwTNnAHjflF5sW4oETbYgLHlLhku97JRYAWIA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=XRjxcezi; arc=fail smtp.client-ip=52.101.46.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="XRjxcezi" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qNvnLOvXQQWvougPO9UaCZ8hYhcue7jxnM/X+nnplnuI06AGdB/OI6RN+wIyNvGNtJqRqhLAx4B7soz7LjNYhCSIUjnTzpYmZ/ePxz51Q8uyb2BPCx5rS1uXnDachS8/kuTsB8FPCAo2ipCxU9oZOVtOyCggIy/OtKcZjE8yEtMqwvLKAicKlzR1qOhtR3vXse2Iw/RrZDtqgAXoyEof1IbmvjQINK/onMgSL/Mu9ynVBaPYzgrcfCjEr/JhRBk4/Zyond1a0716KD/YBxcAxnV6TezJ+XRtQKHgAl2klRYcJ/NZD9ROzvnZoL6YNKbszIjNBHn6cu7e+PyFGebLXA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=W+AoaXP3WdW5VKzHFnzRo7fdCCcgWzp6Tzt4YTymfF0=; b=hm9wmAeqZOKlOKw6IXIXTH94cn8FviNOmrlVBAs1dvIRZENtWZ+AVTn+WzL6RkPYNZKyFxxi5CAfprs5ZqhFQBlmJ6pB49QM3az42FrGHBWs/SJ1b33p+WbEfHamIe3TYByKRNXyC0bTv7q2ctKrKzQt8q4OW1x2EBL+onM0DzFNfHtpbflzpyITj4d/FrOICa0p7LDloe0eMkBfPJj6YpHdauRGSC16WoDT2A73Ek1J67pDLrNEt40uYd9LEX6790tH8o4az+T8v1hyu/n5okBEoQOEAFyg93XAkwjZJjeh4ahAHC7iiUYoGTappxFsG5LdZxAPa/zlqvucbZd67w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=W+AoaXP3WdW5VKzHFnzRo7fdCCcgWzp6Tzt4YTymfF0=; b=XRjxcezisZ/DOfT6E4GWmUj0fqgqxgfotm6tvGhMW2YbTxYIRuae44MoTJdkuwpznp5l+oO0RS6aNzVCARDyYiEOOZ6ROD/IxXACpYjy9rTH6CBUbpr78POFNQ+K+RZP7upWlISq1zB9+z4fiEbX6qPNrd3JvAJysjpFfVnNAdrBka+W17dWN/zvKTnO6MnIBGgtTTrPtn9wRRG51FSeQ/AiCbguuCoae0s5I7USPxELHGd6PrOlBcGWkkFgy5SL7laHWJPfCeWLZyE9hrHeU0vDB7h+jB/aAzc49q5pCI1xZOKNyNgTbSoIKZ8roEbVtFHYWSD1kEWpSHqpaKScKg== Received: from DS7PR03CA0320.namprd03.prod.outlook.com (2603:10b6:8:2b::15) by MN2PR12MB4439.namprd12.prod.outlook.com (2603:10b6:208:262::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.6; Wed, 25 Mar 2026 19:01:08 +0000 Received: from CY4PEPF0000EE32.namprd05.prod.outlook.com (2603:10b6:8:2b:cafe::b5) by DS7PR03CA0320.outlook.office365.com (2603:10b6:8:2b::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.31 via Frontend Transport; Wed, 25 Mar 2026 19:01:06 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by CY4PEPF0000EE32.mail.protection.outlook.com (10.167.242.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:01:07 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:46 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:45 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:41 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:06 +0200 Subject: [PATCH rdma-next 06/10] RDMA/mlx5: Fix UAF in SRQ destroy due to race with create Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-6-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Michael Guralnik X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=3918; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=jG4K3gWAL+oCtETuW+eR6WjLnBjgrjVn5MCcyIZ2jJY=; b=m49QOuxewFMfhZoPu3UkqQsQUSj97bKse3qLJaq058nz1k79/16uXSSnD0aEGAj64ZRUSIu+Y xbBjWRrWxU4DBSyAIvZOGK8Wt1uX+Ni1Jcz6Hn7DYT2z8ObKHgaWQYY X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE32:EE_|MN2PR12MB4439:EE_ X-MS-Office365-Filtering-Correlation-Id: 0cf4a8c8-2ffc-424c-473e-08de8aa0df6d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|376014|36860700016|921020|22082099003|56012099003|18002099003; X-Microsoft-Antispam-Message-Info: Z34JLQ0/0VyZdsopNVVRTao05mPnVOT4sWZN8VCupZ7YRyubC02v/xsk1+5CKtZD/WBrWeQ5InE/RWcex7wtgj+HfmCheuH0luwRyXqCyOPqosmmgrVFljIK9Q3RC+PWXlo5XD1hEjZoyVQc9FC6y41h0ki9L9a/J9l9HdoHTClpqvJ1QaxYJmT7dc6ESKSxU+xLES/lVsKOa6yv4PTjzqCopg/uvbykdjc6fbsnu/C9VleXzzHCOoYFfS8RBvsQiZTH+t8bVtds4TnPpDWCJ5iei6jkclFHfNx0SPG/ODfJKwbrB3EPxUup8s6lZyzUeRSgUv4/XcJLvoHOBJB9+5IoGTY/6Nrzh7flUTxQHd4dMMuwLJsYGNWOrN5vJS9MjFAl2nhiVZ0t+IG0eueYazYkrxff6JL6h8YmW/NdUFI/H2GS9O8YSHYUY0Ot1EgfMdtX8+IT68ToAHs4o8WQCT7yGnPqkTVq7POCmGf0xjkOdA+E9F7SazcKAcFiJplCGBVtavVLMcdAonP17ksrFCouGJjrteBpKHoyiGd9sE2y9A7ZJTmbHWgYdlkYg7ORrMb6V6DXFCXqDTnKZeH6Qxb24zofWSae+DUmubs7ASjsFGmf/eGbZ8DSG5gzzA0K1wlBkbx/99DVg0pVwTZ3Tbgcz2+uxWbWnHkHP3FtHe7cqcpdNiPSVo00u50Sui2FANPLfS4P4e4HKHY08ZfQ5heXEHoojDTRIfti0QJ66AIYUW/P2VrDWdm5icdB1ZmrddkJ15geN1/u9ZNiCXpq7wkK6nEVRBDDvpFBeyKl1dVru5Wdq7IOYMxrAVaB2J+s X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(376014)(36860700016)(921020)(22082099003)(56012099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: U6XBrM36D1qs68t0XNkQ/g7j/IOnC7jTFLUkclN7bOmL2N/dmU50mMnN9J2UsXQZJtKXt+1RZA03ccHv+10Rbjl8CfwPiJVMud6cJej8ZuBz5jrz5Z/Zqi7Sy83lIkHbXUeRDb0RS/zAqks2PvVdkwLGLu8CKD73J+hiajygKhP8P/wZxZBF11tEAI3V5VdBohiAjcbCZy0YPpXS2WrJzO5RFIyfx8b2QkUo+cDOy1HNXps1MpvLdMgfm0qhMT8/IO5fzVEmRNEt5hss9LY811eoLCefmjK3isHlH/vqlrnM+MFJSV1bG5iafrALoJx/mT20FYWHVYbfMUzmobiCsMpat6Np6JhChihWxnQvbTcLlV22u0uzYgJQPTGBbFsbU6etAK+Ex46Tu/jFstZfun/PKvqHOhTcjC52+i8vHsD46DUK1ZbbqAwsV85B3+Ao X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:01:07.9978 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0cf4a8c8-2ffc-424c-473e-08de8aa0df6d X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE32.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB4439 A race condition exists between mlx5_cmd_destroy_srq() and mlx5_cmd_create_srq() that can lead to a use-after-free (UAF) [1]. After destroy_srq_split() releases the SRQ to firmware, the SRQN can be immediately reallocated for a new SRQ being created concurrently. If the create path stores the new SRQ in the xarray before the destroy path erases it, the destroy will incorrectly delete the new SRQ's entry. Later accesses then hit freed memory. Fix by replacing the unconditional xa_erase_irq() with xa_cmpxchg_irq() that only erases the entry if it hasn't already been replaced (still contains XA_ZERO_ENTRY), preserving any newly created SRQ. [1] RIP: 0010:mlx5_cmd_destroy_srq+0xd8/0x110 [mlx5_ib] Code: 89 e1 ba 06 04 00 00 4c 89 f6 48 89 ef e8 80 19 70 e1 c6 83 a0 0f 00 = 00 00 fb 5b 44 89 e8 5d 41 5c 41 5d 41 5e c3 cc cc cc cc <0f> 0b 48 89 c2 8= 3 e2 03 48 83 fa 02 75 08 48 3d 05 c0 ff ff 77 08 RSP: 0018:ff110001037b7d08 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ff1100010bb9c000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff110001037b7c90 RBP: ff1100010bb9cfa0 R08: 0000000000000000 R09: 0000000000000000 R10: ff110001037b7da0 R11: ff11000104f29580 R12: ff1100010e2ac090 R13: 000000000000000d R14: 0000000000000001 R15: ff11000105336300 FS: 00007fa24787c740(0000) GS:ff1100046eb8d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa247984e90 CR3: 0000000109d59005 CR4: 0000000000373eb0 Call Trace: mlx5_ib_destroy_srq+0x25/0xa0 [mlx5_ib] ib_destroy_srq_user+0x21/0x90 [ib_core] uverbs_free_srq+0x1b/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1e/0x50 [ib_uverbs] uverbs_destroy_uobject+0x35/0x180 [ib_uverbs] __uverbs_cleanup_ufile+0xdd/0x140 [ib_uverbs] uverbs_destroy_ufile_hw+0x38/0xf0 [ib_uverbs] ib_uverbs_close+0x17/0xa0 [ib_uverbs] __fput+0xe0/0x2a0 __x64_sys_close+0x3a/0x80 do_syscall_64+0x55/0xac0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa247984ea4 Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 = 0f 1e fa 80 3d a5 51 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff f= f 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d RSP: 002b:00007ffecfa79498 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000200000000080 RCX: 00007fa247984ea4 RDX: 0000000000000040 RSI: 0000200000000200 RDI: 0000000000000003 RBP: 00007ffecfa794e0 R08: 00007ffecfa794e0 R09: 00007ffecfa794e0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 R13: 0000000000000000 R14: 0000200000000000 R15: 0000200000000009 ---[ end trace 0000000000000000 ]--- Fixes: fd89099d635e ("RDMA/mlx5: Issue FW command to destroy SRQ on reentry= ") Signed-off-by: Edward Srouji Reviewed-by: Michael Guralnik --- drivers/infiniband/hw/mlx5/srq_cmd.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/srq_cmd.c b/drivers/infiniband/hw/m= lx5/srq_cmd.c index 8b338539659933aef94a3e2c056e9400c3fb9bb0..c1a088120915c5741f37ed44fd2= e8139bcb6802e 100644 --- a/drivers/infiniband/hw/mlx5/srq_cmd.c +++ b/drivers/infiniband/hw/mlx5/srq_cmd.c @@ -683,7 +683,14 @@ int mlx5_cmd_destroy_srq(struct mlx5_ib_dev *dev, stru= ct mlx5_core_srq *srq) xa_cmpxchg_irq(&table->array, srq->srqn, XA_ZERO_ENTRY, srq, 0); return err; } - xa_erase_irq(&table->array, srq->srqn); + + /* + * A race can occur where a concurrent create gets the same srqn + * (after hardware released it) and overwrites XA_ZERO_ENTRY with + * its new SRQ before we reach here. In that case, we must not erase + * the entry as it now belongs to the new SRQ. + */ + xa_cmpxchg_irq(&table->array, srq->srqn, XA_ZERO_ENTRY, NULL, 0); =20 mlx5_core_res_put(&srq->common); wait_for_completion(&srq->common.free); --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from MW6PR02CU001.outbound.protection.outlook.com (mail-westus2azon11012061.outbound.protection.outlook.com [52.101.48.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88E2630B529; Wed, 25 Mar 2026 19:01:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.48.61 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465275; cv=fail; b=lVCKpeO0WkW5CUMG0nkw5y5wJNZR7g12T+IIDbXymT5kXGlxobl05tYytq4w59ycLLneKhNrfTyl//hs3se3+pL15kMPpvZLfq8P3BXbgbzE4p3Z6JzjouY2MkwqYYpViye5PtpLVrrOxNHDkeWyr/5ZJ9q9jw5F+1jhQZD55So= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465275; c=relaxed/simple; bh=fqOQHBTsMGDyYBanPsNjePtGmdZDn4173XYf0fqm5Jc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=RXOapNV5xN3v29jeXOofoC8kcYYJxT6xwMuxmwmfDa6MbhPMhFP5kUMQK4epDA+7z2pZmPGzChw+OLDoMK2L54CykM4uSYGZks+nAtjCtdA7BV1SpTqZAdIzH4WFNKx2f9OsYaTFudLU0GATrxenhJ/Xo6Oy7PVI5tKzjFJ0G18= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=Fn/tU+cp; arc=fail smtp.client-ip=52.101.48.61 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="Fn/tU+cp" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FO3eMZ8IB9wH7sUm42IOAhBjCIOrLEmtUaTOeaQNDRz0M+/6zmWHk1ztRCSUKSyuG61i43NCJ8tTcjQZy5iCzkYzNgxm0Rz1C56bJ6Pq0XTGRMeAtJSxnSsdi/q3VyciOuB4XVwayh9QCorAqu0B11lzI2ZHAtXlc4t1sjA9r0wLCuejSmFef8SArk07sSmyUaFkmlZ/2glA83/A7lSCjdUSQDf6fkWEbb79pmfh5liZ2RdHSrTfr32NYUiKNmVkwlOLiA4kcVI9C4m52lqi7eOnVy90k2YLaeIXh12gXpjepegQ7kzkrawnb1ZQ5AlIDG3TH0XoLSxPgWyjrJ6fJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BdrlkJezMnENZVh5CigvNI2d54O86poiPpOc5lFYrsU=; b=JBEDGTomhgdEKYrVqkC1b+t/s+lRmzQqkwXg5KsznR7oc1GZyL+LDHh2c3kUd8g9nDXLMENkHuneJxORLWZQ9skkqN+1Sx20QhWo3680Eyf1cWyz3liSA5wGZJb4DNGuDmgGRAsZtgP2QCsJNKmtI+c6ruJzzwnOWleLikvGwJ7Gjat36CN8x+2ad+ATJLeCwlfLxQlTN7PMuWiOo2uYcJ//A9IeNkpxqeq64pwQYPvhhjnkEBPbS6BZfHpgj3eykf+ARAWIz0JnNUrXkuF4w9S1cQvl9p3Il7nfq5vnYPGzUc1CthO0jIM5mQxBi8on06t3DPqQwX/4xaSQi3C1UA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BdrlkJezMnENZVh5CigvNI2d54O86poiPpOc5lFYrsU=; b=Fn/tU+cppN519BCGorZKfVIke2VzPC7Dsrt3UXzP8RuWnzfvV6qBo1B3w1V5BU+4H5RDgkq5SbJ5KUNhMP5WJiKFDt9Ybx6vnDTazAly1c9RhDnoMjGzOe5AstckbftJHTTY5Sfrzm0IcbQnbM5xad+WhLw6fmTVJug3nX/yfBYuL35ye1r2YFt5KroNZ6Xfh+fHhkYwdOMD395J3LMBZ2v59BPKDzqDTG5x5lVByWzVRwlR19lJ8vzMGvibzGvMxQY/3KYBbRtBKz8PloxIMDK8ffPnDH28VQ2UtFlHZF9UFTE1AgYTxi9v2fHJ7kON5Ia+vpy3C0H7tuENRYs25A== Received: from PH8PR05CA0005.namprd05.prod.outlook.com (2603:10b6:510:2cc::14) by MW4PR12MB6732.namprd12.prod.outlook.com (2603:10b6:303:1ea::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.20; Wed, 25 Mar 2026 19:01:11 +0000 Received: from CY4PEPF0000EE34.namprd05.prod.outlook.com (2603:10b6:510:2cc:cafe::dd) by PH8PR05CA0005.outlook.office365.com (2603:10b6:510:2cc::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9745.20 via Frontend Transport; Wed, 25 Mar 2026 19:01:11 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by CY4PEPF0000EE34.mail.protection.outlook.com (10.167.242.40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:01:11 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:51 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:50 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:46 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:07 +0200 Subject: [PATCH rdma-next 07/10] RDMA/mlx5: Fix UAF in DCT destroy due to race with create Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-7-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Michael Guralnik X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=1831; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=fqOQHBTsMGDyYBanPsNjePtGmdZDn4173XYf0fqm5Jc=; b=HVrx5zywE6frDApwvCAbVdObCyGeI14b++0nawIjjCi6XlAH/6DXshsCiE3bo/KR58xIQcTdk P1EcaxC9qUUAlNAQNPuYvCDSEIfAXlNIlcxqZq1JW+We1F31JUaVbyg X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE34:EE_|MW4PR12MB6732:EE_ X-MS-Office365-Filtering-Correlation-Id: da48f3ec-5cd4-49dc-f2e2-08de8aa0e157 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|376014|36860700016|921020|18002099003|22082099003|56012099003; X-Microsoft-Antispam-Message-Info: GakfGqxhU6ttnxg3PzkbMirAwAsbng3BWtHEg7tSrQ2KByWg8ZF72t/AMKMDXMxKBR7PrkOfg+1xoNQW7ShybO0Pxi/sj9DVnCDkeZeGfJV4V2+c6eOFx/hSP2wiieI9zqJo1l9guFyXaJdVP7CBA5ZP51tQEBlipiyCm6W/5UCw7cRQArBuQ4krj4w5XjVUAdKrcCLf+5fQYtQ8ZOgZX/8LPVnGAlfccsLmPr2wAHF3xx1ZO12u8uKAc9/PH7jCi5UCME260dneek/rdr4B4QredewIl9ffu0qqwI3Yd1e9b+omvayOHGTqBR/qeOGTidOFo3qaMqg1Kx2LUPxQ7jJOG0N7vlUL+mGfDl9r92a4bilsA8z5L12E5E9iew0lno+OISE8iorcbMd/xamSAA+NMbk/lQENWYziX5/Lbih7OcKk7vBETHhbeukUHw8nUTcZYS3tQfaeXCjKlGAaqKALVmj3MSBy+6IQdIM1AFmXwvvORXo3h+jy2sRsqAzMuzEpIeK9IwQOnLrjMmDKW7Aor61Db4X1KlQDtt24xFFqbijgElwTOfR9oHlJHere6juVoti6OavQz2CTDO2oCMHAf2EJf6eCImlEb8ht/i7VYfYyeE6bu8JBvdyrFA1itNdA9kwqT9AzZoxnHEvYDZs2bRUH/T8T/PQui5dy1OLTAJMA6Jg16586lxuCA14rQVvCnSlAZkVE9gCH+iCQm/l9WenXGwbWvmJTzBew9O4/QrXo9hyuTq9ypxTirvOiB5Z40rp5A2OOOoWt3cet7vp8tpymSqlSzGADUE2nA8c4cguaQ8LjKIsAP8xV5O+l X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(376014)(36860700016)(921020)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: E/P27WPV6d+8H2jf3vRjdTQDcdX8Z/Miz+BguKElOqu3WwuLCX0gWMToMBol/qq4w33mUY6tcOzUwPAXPLXix2uYMl6dcCfMoZTJsV+VPPNDaFHQKPe+7OxE0dKnEdDHaQrjqFFyXh7CibB4XCFZTbl8zXfLkMZTSdBcwpfH7h9e7PJ6N3WDkInzhcJ9i3Z7vhCQCVIps+vLR6vDC27Dg/h/TBSn7XhmXeatALrUxayZsuvaMaDOI4gJzE8RGlrH0wQ80MASPRyTMr+ROzwN2MRNjR6tkJ1+o25P8YUAeHAHrZdNO9Nr6LSUecgQ0onbRjl6nSEmHH0q47vy4t81qfAh5trjiDMWXGDFpKWor7D5P5UTN2nBhu2IN01MFCvaSPc7rzmTGyBNtGYLB02uD10SdwM+MPHZoA8e4J6slW9KEnsnsyRJKQvQ0WjD3J5q X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:01:11.2095 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: da48f3ec-5cd4-49dc-f2e2-08de8aa0e157 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE34.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR12MB6732 A potential race condition exists between mlx5_core_destroy_dct() and mlx5_core_create_dct() that can lead to a use-after-free. After _mlx5_core_destroy_dct() releases the DCT to firmware, the DCTN can be immediately reallocated for a new DCT being created concurrently. If the create path stores the new DCT in the xarray before the destroy path erases it, the destroy will incorrectly delete the new DCT's entry. Later accesses then hit freed memory. Fix by replacing the unconditional xa_erase_irq() with xa_cmpxchg_irq() that only erases the entry if it hasn't already been replaced (still contains XA_ZERO_ENTRY), preserving any newly created DCT. Fixes: afff24899846 ("RDMA/mlx5: Handle DCT QP logic separately from low le= vel QP interface") Signed-off-by: Edward Srouji Reviewed-by: Michael Guralnik --- drivers/infiniband/hw/mlx5/qpc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/= qpc.c index 146d03ae40bd9fd9650530fba77eb7e942d5fe79..a7a4f9420271a228e161aaac1ff= a432d304ce431 100644 --- a/drivers/infiniband/hw/mlx5/qpc.c +++ b/drivers/infiniband/hw/mlx5/qpc.c @@ -314,7 +314,14 @@ int mlx5_core_destroy_dct(struct mlx5_ib_dev *dev, xa_cmpxchg_irq(&table->dct_xa, dct->mqp.qpn, XA_ZERO_ENTRY, dct, 0); return err; } - xa_erase_irq(&table->dct_xa, dct->mqp.qpn); + + /* + * A race can occur where a concurrent create gets the same dctn + * (after hardware released it) and overwrites XA_ZERO_ENTRY with + * its new DCT before we reach here. In that case, we must not erase + * the entry as it now belongs to the new DCT. + */ + xa_cmpxchg_irq(&table->dct_xa, dct->mqp.qpn, XA_ZERO_ENTRY, NULL, 0); return 0; } =20 --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from PH8PR06CU001.outbound.protection.outlook.com (mail-westus3azon11012037.outbound.protection.outlook.com [40.107.209.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33E60330D3B; Wed, 25 Mar 2026 19:01:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.209.37 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465285; cv=fail; b=OpCLZ7ls9bHXkL181dyn9IRw49EruM7drGljnDkgaUHWWhQsQ0X5PsZCfeZD/QlTlzf2D71xUjDfTEZ7nNe48ndLZQMNnEdCLh4azuBUqZj9CFRQn88QVHrNM6SdaisFFtxa75DlfVtvflJfsnHCvPZTwQwQJjLRBlnXItqwRBQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465285; c=relaxed/simple; bh=Zh2rUBWQpIo2/xyLHnFKLZ6Tven2bo87Z38Ga0768d4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=U0QKWaoYOE6lnlXU+YvC5D5XhETkXurUsAXg9/ndD+G2wglsqTGmuxA0N2XXldj8P4jksfQSjZYtmDsT2rZrQ/Ab2USvg9ZyXRZ56O8zqFOruDL9gYY03hUlGKLG6TpGQg1hTTwaGprnfC6XxeMgSujxhiJKnUb4EzaltYVeQhY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=dY26AFYQ; arc=fail smtp.client-ip=40.107.209.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="dY26AFYQ" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=EsYYZT7bKSQGkL/mtjJ3/LONEmFk4NETSTh3CMp8xZyHwYNyzG9qal+LWgy4BQmguwf26p5DWRImk/seOyZdxDNYQnBbVWZVv7lT4b9NsufWO484TkJm/y0ileCxedUsldughnrP6GjALHMvDSYZaVicLglAQclcVg1gGiPWgb23Lm6hEllAUpfSh4JijCxqa215+QvqDA2BLkywsFxPveKyNh/kaFHrFEQXKfcoIJGP+JZNGoPt202q097qSZEDg99/GoXuEks8dE2CJyCMI7Q1B8+Pc/3LBSkgP1JUqcvG3su5wwrMd9a+0ZL6UjK0JlLascrZJ2TzIWgcgEoI2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=crNdKivXMu1GoV76KiDQo7qUGaVVFO9lEawP2F8huTU=; b=jx/oGLYpdMcGHKTkpKWotS0Hs7efS0PiSqkNj928+kLiIOi5z2YQyLfR9Uf4iuL5/GvXMmnMsyJWbGHBAsjfZ0dBpLl3DQyLz4KiWcY2UJcADaD2mNPfaHMuT49s/tnO3RiEmFoEnboncyDsqL99URB2208I/eodD42Ag1RoRW0an54u/j9goyzottUIVJSFKdmzJFkcbhaCB50nbY2CyDf5MZYB/+zdVjSU7bpFlMulYTPfkrN/CNjHYgTXd2nadhFlX4THfTC9TXYbETh9TqbEjZnS9APZNuDbo0d2vwkTmgfywtlVjbLou6VtGxYxUl4aXOALXDQpDIEfENCURA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=crNdKivXMu1GoV76KiDQo7qUGaVVFO9lEawP2F8huTU=; b=dY26AFYQ8aeKAiOV0NQHLp0WTe7WQN1vR53aLArCl0h/tobf4VZy//c4uvan4hfRa3sygGLy4j6QW8qcffG2vnNqYH0lGyxnpM/DdX8PUTbnrTHcjVZSurvORKJVNybpEZIQvVAaVB+6JZH0EadrZ9MegoTskpNUWui2sIjh5we2RbL3SWpxRI7fEVMEvo1Zn3suzirZSJCzXX4mt/z+HwrUuit7KSM4vliLIKFrzxu9IOIyv8gUt5W800kRE6jA7PmjsQQNphMp21gQHfznPUW80Hw5umwloy619DPf7Ro/YKPT3/WPODImgdMp9MZ5lvvfv5dcZa2zDmSKlXEpWw== Received: from PH8P220CA0001.NAMP220.PROD.OUTLOOK.COM (2603:10b6:510:345::9) by PH8PR12MB7421.namprd12.prod.outlook.com (2603:10b6:510:22b::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.20; Wed, 25 Mar 2026 19:01:16 +0000 Received: from CY4PEPF0000EE33.namprd05.prod.outlook.com (2603:10b6:510:345:cafe::c4) by PH8P220CA0001.outlook.office365.com (2603:10b6:510:345::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Wed, 25 Mar 2026 19:01:12 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by CY4PEPF0000EE33.mail.protection.outlook.com (10.167.242.39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:01:15 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:56 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:00:55 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:51 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:08 +0200 Subject: [PATCH rdma-next 08/10] IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-8-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Maher Sanalla X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=1480; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=Jq8SMqoLS1LE7WfgI2KdbBbflGEjDYrMCeWBfgAspUw=; b=QWXh0ADSQzzg1fwaMTjufpLRZ7t//hQjUcMUYpvG6IdciXG6uSzH9ISJrOIJLZQxGYfGh0ooG fD5w2glnwblChB9ObDYAD+nBPk0SkgWAcqZEZt4ywThBh/hNFh9gVks X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE33:EE_|PH8PR12MB7421:EE_ X-MS-Office365-Filtering-Correlation-Id: 6263c538-dc3c-4a3b-eef9-08de8aa0e423 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|376014|1800799024|82310400026|921020|18002099003|56012099003|22082099003; X-Microsoft-Antispam-Message-Info: IPXUIjpcG0QusI1eGVr+Ei/Azgb2PYVsKzae4ciFcXNyPr3KAWN3XynsvbzEBoayh83CgA6lRXO0+Jm6HPut5JH2vUQ1gTGryLOXS4RF+K76KzBe5wCeBpt5BXNRpNTTqD3M8MO/EAq7IakFUWIv4ygiGytMi1LAfwCR4j59xFCLqfOPDHcPVpag+n/+jBrFLu5N45+whEKwsa5Bx5iBkUf8UhezflR5hG8+D60iinE2wtsXKKiIUdEpiLTxtqaWiTu1vz/GYB+wTuhB/fw64h3+U/T+Bsu/+EtXUcybOFVMLJ1o7xHsxi8WpYmPhCdrfB39AKjYKG69W75PG/e4lF769C43seY+jSA8neV+9YpDe1L/E2icdw3IZSuq4GsZIj/AFSvekjHMk49qsTcB6ZL8k7BsW1jijowNXcWxJ71hcCMy+mw4g4Kk9PFvNde1Py34a49gfVnKK8f2JIu0GBLSsqbyYrEsvmggkJ65Yg+K8rCoWFB861SW6WhBLsN4FzTiApvHCDHG8Rz7xDUh21BHHi8L/SMZqD2f6pZ9wHkCo2viELNMQrjeptam5peir1CA6bi/DNLjhwXgm6daDQEXMDyWPzzVxSHFwTkIUXV3svJoJDMQ4qMFsYY01H/YV3PhTdIVq+n1z7m1M83TcVZ/3LRDEQVKPuM46e4u8IgdrnotkXIJDjB2R/h6fWxFPuNLqp4ZllnrPb6lDiK99Tx7wQh9OhW+UYaC5irqSvNsOiRmw/3GiExrJkIkRgEEJ+KXozzOKdnPBOFE3i9impWxMko05uKRaL/KKG01QEJfqWCNt+CRBZeZ6rMF1+LK X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(376014)(1800799024)(82310400026)(921020)(18002099003)(56012099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 7KRwZ4Zaqk1+g10wT/S1NkPKQd/+vU3kPrTssEo2tCYpmTofoeNtaq0PXPuW4kX4GAAeX/RBqb2fVD2iu21jOQxf1IdQrwbFNUn+Byyu0B7Hj4lmNHBbfpK2XwCEWtrqDzRq6Bz99ij/0AYFxC9dnrLjws149AS/W3sbNr1tN58GpdyaMwHo/MxkypI4cEiuxbTesg4iU35xzZUmiralYU4s0eisb9/FmUMW5nSxYWEUrNwyNc14tKDSX3MbNr0IoYWgpO69mbeTKtJka7UXY9XoaJW9OdDUMaNQvDKytJLHvc//cvhJRCrQfDkOJRDMLLb4ege9cVlNaH8QZzlpdKa1boI72zUfJwnGaU09e/sSo70+0vAKFGe7W0LKtV/EaXOaCsJ+TytKnoFyQNlcJAqIh0NogpQEbcEtGT+MKV5/UECgNt5NkyxyRezrb8cn X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:01:15.8816 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 6263c538-dc3c-4a3b-eef9-08de8aa0e423 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE33.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR12MB7421 From: Maher Sanalla When resolving an RDMA-CM IPv6 address, ib_nl_ip_send_msg() sends a netlink request to the userspace daemon to perform IP-to-GID resolution in certain cases. The function allocates the netlink message buffer using nla_total_size(sizeof(size)), which passes 8 bytes (the size of size_t) instead of 16 bytes (the size of an IPv6 address). This results in an 8-byte under-allocation. This is currently masked by nlmsg_new() over-allocation of the skb in its internal logic. However, the code remains incorrect. Fix the issue by supplying the proper IPv6 address length to nla_total_size(). Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload") Signed-off-by: Maher Sanalla Reviewed-by: Patrisious Haddad Signed-off-by: Edward Srouji --- drivers/infiniband/core/addr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c index 866746695712aeae425100eefb231e44d52d52d4..01c8e8806eebe511b405d17604c= ca28e3ed92571 100644 --- a/drivers/infiniband/core/addr.c +++ b/drivers/infiniband/core/addr.c @@ -150,7 +150,7 @@ static int ib_nl_ip_send_msg(struct rdma_dev_addr *dev_= addr, attrtype =3D RDMA_NLA_F_MANDATORY | LS_NLA_TYPE_IPV6; } =20 - len =3D nla_total_size(sizeof(size)); + len =3D nla_total_size(size); len +=3D NLMSG_ALIGN(sizeof(*header)); =20 skb =3D nlmsg_new(len, GFP_KERNEL); --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from PH0PR06CU001.outbound.protection.outlook.com (mail-westus3azon11011065.outbound.protection.outlook.com [40.107.208.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66CD53563EB; Wed, 25 Mar 2026 19:01:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.208.65 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465288; cv=fail; b=VGwUk8xtJUnkqLBlPN/R+W6BuGT3YPRUP14DD59WH3DaZqpHqWvqxQjaQevDgg3cpnPVum5HQCjEETqgL09Wlcm4Ywr6bYoTGRHWN19uMWYJ0H0wLojm81mRe6EEE5eJoZxr/WILpoAf+FASD5/UfHA/tKqM1+6BfmBctO+xovw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465288; c=relaxed/simple; bh=HpzpnaKGcCcSb+984F7Z60MPP9ReCcmxBfKAt0ez2yw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=OFIb4IN4wHCWKM+NSUCXp49Vef95fsjJbJi8T5q3dEY/BTsK2firdWnU5eQzVv0VTASc8ZV9hGqnbYBu0pfDKR9zczRdtyTE876JqXI1FpxmH8rnf09ciPbzBdB4ORm7+GzJXwnkmNWu2AXxZykOrXAI5VY86Nx3G2GJh77Fg3A= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=GsmxL8VH; arc=fail smtp.client-ip=40.107.208.65 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="GsmxL8VH" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BMjGHSSTtfEPcNYgqQhmmykCNkmDGaE8nlhlnZP/swUbFvS1nUzYxb2g18UZdU6OcpHjp4qwutxrZakt6ZMblcKPTJfEojK2CWgR+L9eEHeigi0tKURRxVBhMaGh+88DUm9psbJIlpnQvYWjpihu8THMrKKDvGHdeT2sDkB+Xn6k0pwdCDyezJfNyReDFN7FtDZRbkZaQD+bV2Mn1C4x8fNlm1tDZ6NtpvaC1Xv+Q3MBt841j2qGApsSVBPaEMFATBCWYvZXDknTVvP6DPwwlny8bQNBLIM4u5Y6DNsH5TgP1ZCEscdUyELVZYMtzMf8iGfwQNNrVViXyn1iWU/GtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dWNvwNU3G9i+nUe96uBuBDeWT+SjQAGZmET9NQQkc8M=; b=wUvjdORnqk597s+NKL3fIf0j60FiySW9uDpCXK4J2b2E+SaBaGuq7n2n1cofEja6f6dLvzrpHpUs5C7DyXPgfKhTggmOoDJoxHey4A9k9d3LV9qPDltLuUP+F5nZML09qbJnrh9KeaaKyYfNoGkEuXekgeuTPcrpMWL9/0Ht9AlNjCHt0q3NdudQH30NffZYrNHrUeZkWiuFmD6N1GbkMswTFuQjLMipVmQwg2hdDxxMXXsSqEykC2fTT99KtFMpdNnk6uFJ+e0Dl1BsqcRWJIo03ZxwxzyDd1nvCd/MuZ2/3CvHi4Y7jVZYTK7/I8geR6Ez1bZClvJR2/vV5vaLCA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dWNvwNU3G9i+nUe96uBuBDeWT+SjQAGZmET9NQQkc8M=; b=GsmxL8VH4QFYNFTu2r01mKtx/eq53y1CjTSnK0cmco2SMFswBd6fsZa9XXziM+ZbsFzgXS522EGB1l1te0hkMj6Fs4V2dR207l9n1/ixCo61++/NweYTLr4Yu6sYyJ1LhcWIIbYCe1g4RTcJEW6i/q0xBGg1O9Jo0vA07nwW9tPY9Li0n6c+YHGTA9F5lGjpGKZY+y6bu673h0U9WN/XDAagSgB/DDAP5uruTWdapX8yB350UkxMIMbyvzUnJYdzceYFm3JQ3IUc4ol4W9uyC9rPaqO66kVXnCdMJDKZWWT6y1NSt+j3Q2QiX95yTgyb8Zd7iHTEQ5UJJ8ZvzKcr9g== Received: from CYXPR02CA0052.namprd02.prod.outlook.com (2603:10b6:930:cd::22) by DM4PR12MB5772.namprd12.prod.outlook.com (2603:10b6:8:63::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.20; Wed, 25 Mar 2026 19:01:23 +0000 Received: from CY4PEPF0000EE30.namprd05.prod.outlook.com (2603:10b6:930:cd:cafe::9d) by CYXPR02CA0052.outlook.office365.com (2603:10b6:930:cd::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Wed, 25 Mar 2026 19:01:21 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by CY4PEPF0000EE30.mail.protection.outlook.com (10.167.242.36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:01:23 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:01:01 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:01:01 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:00:56 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:09 +0200 Subject: [PATCH rdma-next 09/10] RDMA/core: Fix rereg_mr use-after-free race Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-9-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Michael Guralnik , "Maher Sanalla" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=2925; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=HD3aLo6Y2la0d4ALg5OXwr7GfoYNm3Y3+oMXGY0tChc=; b=L6KsfKrypV/LuOrXeoM/V3F7f20LWwSoo2JNN8nEknLvRpDg4eTJOWO5qkJXATKzhTE1EPiYI O1PZxQv0sceCzrCiUKJy3WuoFYa+4UV0wF9pgBRtiutt7w9b7MXHB36 X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE30:EE_|DM4PR12MB5772:EE_ X-MS-Office365-Filtering-Correlation-Id: 5b53a5ca-3438-4829-4c00-08de8aa0e86b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|36860700016|376014|921020|56012099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: 1K8EVh3/eUFxIzHJn2LXiZKVfn1FjQ/4aZ3yPr7vSbpypJZX0tdEeu21qi+LvrmET6+q3gl4uXi9xLbqW/UR2Lxtw+ddc4o6U51DAdnYOm1LyFX6j309tbnLlK2+rpgDNLrn6VuTaxcqSuylURxoaLLik/j1xZkA7GsyahYy1HZibAG+J4n/o4W3Hli9EFZHDz3vc0YOKpGuKwDTcGUJtl26aBR56Kig/diGe+7p2XBbTbtAzt1ki2gxVsxr7oarIm1AgN2j9uBit1lxofjTDjyzcnk0Cu08rMeby+NYzot9tPj2ft/ujOkV7nGgd/ZIDspN4sI+b3WuOyFT9LzqO9nnKlzn5BiXLSCdhYrSMIImemAP+wJG6JAVpltjyFbCtWA767Wv41IR5Lg3KSsUuj+sMg5RCcUyM4Ot3FgfPOW8EYQx/lhr/N9Utkkf2OC847vHduO2vgmF0F3jM17xHyJ3mYTHAkoCUwNVNI0mfEOIYye2d7j5uvMme8zgDVxlMX3omGmPH8zMQk0DlZyXIlj5qpNjkNIzEDFKyNKVJouVo44HlNiKyovCA8omMGw5AsCvut4cv3XVuKg3SLMyD4/0a3QvaMV/yweJSkemfGFP5PHEyQ7aV+2TWd0TRjgVgKlpg3yQi8NUPmkWOJyccxfeNs7YheKfeG9ZzLAOSVcCTj1JqMsfPRWN1z12E6tgwSc61V+/N+p18Z7Qp0f7L4R4P9ACjfI4GETC5KBkbhd4TqeMDWUGsj8JWhDRUmnb43k7NUr+V8Fz7XbBwxhhxuCkN7hScARlTe0uNdRpaZxC4HY2LIr1Vgb+XbmXC7Le X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(36860700016)(376014)(921020)(56012099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: j0mG7+ha/pmk8qXaL3qIbU/BRrtvbwaU1eUdQb4u38Yc7yPQ5YpZ0DOV+B1DgBN7ET2TghLYyhhZ7MGoaWpqqr4KNDlO2QmWdul7FBDfgjDNV99UpLWORiwXN/33yb9sfMMLsv98JLNlCbJu3o2dT34j2woqDbBRSbMdCxZLxqlpTb7H68kkxs30xImLwJFqDBqzxBRcCMJsDAhbhS2PhlAZbdcnqIt79NyhJt1eAuc/F60JkcOrtQZqAiRz+BWGJ2ZzDc9E1EwkMJhCSs1GIB9Y4XhdMKJuLE0ZnP1tC0op/4ZNjfF4Hz0LzABiIMGZYSzjH0w+aidx6AvBSVEBwkiN1aRnad2GyT9LzQ4yafgdA1IZgtA7BMd7GpoJY4f6suqxdMo8/mGyV/41f7SBqusDEWCCZC57bpCSeDjDBHKN5mwNupWnG1uxFaUHsI5W X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:01:23.0862 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5b53a5ca-3438-4829-4c00-08de8aa0e86b X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE30.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB5772 From: Michael Guralnik When a driver creates a new MR during rereg_user_mr, a race window exists between rdma_alloc_commit_uobject() for the new MR and the point where the code reads that MR to populate the response keys. A concurrent rereg_mr or destroy_mr could destroy the MR in this window and cause UAF in the first thread. Racing flow between two rereg_mr calls: CPU0 CPU1 ---- ---- rereg_user_mr(mr_handle) uobj_get_write(mr_handle) -> mr0 mr1 =3D driver=E2=86=92rereg() rdma_alloc_commit_uobject(mr1) // mr1 replaced mr0 and is unlocked uobj_put_destroy(mr0) rereg_user_mr(mr_handle) uobj_get_write(mr_handle) -> mr1 mr2 =3D driver=E2=86=92rereg() rdma_alloc_commit_uobject(mr2) // mr2 replaced mr1 and is unlocked uobj_put_destroy(mr1) // Destroys mr1! resp.lkey =3D mr1->lkey; // UAF - mr1 was freed! resp.rkey =3D mr1->rkey; // UAF - mr1 was freed! Fix by storing lkey/rkey in local variables before the new MR is unlocked and using the local variables to set the user response. Fixes: 6e0954b11c05 ("RDMA/uverbs: Allow drivers to create a new HW object = during rereg_mr") Signed-off-by: Michael Guralnik Reviewed-by: Maher Sanalla Signed-off-by: Edward Srouji --- drivers/infiniband/core/uverbs_cmd.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core= /uverbs_cmd.c index a768436ba46805a81ab5a0b8acd4d64b4f2b1b51..91a62d2ade4dd0ce402604ec283= f8cdc70d2ef06 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -778,6 +778,7 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle= *attrs) struct ib_pd *orig_pd; struct ib_pd *new_pd; struct ib_mr *new_mr; + u32 lkey, rkey; =20 ret =3D uverbs_request(attrs, &cmd, sizeof(cmd)); if (ret) @@ -846,6 +847,8 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle= *attrs) new_mr->uobject =3D uobj; atomic_inc(&new_pd->usecnt); new_uobj->object =3D new_mr; + lkey =3D new_mr->lkey; + rkey =3D new_mr->rkey; =20 rdma_restrack_new(&new_mr->res, RDMA_RESTRACK_MR); rdma_restrack_set_name(&new_mr->res, NULL); @@ -871,11 +874,13 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bund= le *attrs) mr->iova =3D cmd.hca_va; mr->length =3D cmd.length; } + lkey =3D mr->lkey; + rkey =3D mr->rkey; } =20 memset(&resp, 0, sizeof(resp)); - resp.lkey =3D mr->lkey; - resp.rkey =3D mr->rkey; + resp.lkey =3D lkey; + resp.rkey =3D rkey; =20 ret =3D uverbs_response(attrs, &resp, sizeof(resp)); =20 --=20 2.49.0 From nobody Fri Apr 3 00:00:19 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013071.outbound.protection.outlook.com [40.93.196.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59DF831F99A; Wed, 25 Mar 2026 19:01:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.71 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465302; cv=fail; b=r+W4Z5fU/AD0mfIBlwFnjoXC8Mh37QPz5Wy4Afo2GBh4c6Wm0rnllrTBdGfXodPQgYQw0uDy8tE5bTxZ2ifDnDe44NZ14Hs8ytAW4UGQDzrdAtvmCRCsgR+fjpOYkqIzKhOoPqRFp5hcpTiU3ui19mr6awhE0iCjA+0CiuUvg3Q= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774465302; c=relaxed/simple; bh=qhxU3/Ta+uZ2OfL4nrki6YuegYrkoz9bdeqlr60VQC4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=Gx4eK+yJsej/uD5QV5LB9kNJ81KAGtHuisci+U2FuU8yYeuGjYxaUndAFnvfSXS/dACUF8iWfwI/TP/gep/5aK8UcrIRT40RdvlbNIGNABbX/cQRyyYm+IEtZy4LMXAm95Aiv5hylUYrRmr/jjfJLJhNxxUhp9vuhJmBoPY9yvo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=js5Qg++2; arc=fail smtp.client-ip=40.93.196.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="js5Qg++2" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uhmYUX6AAhknD3w1Ox5pTewkeYbCDZiN89K2X7toTB7QKEkehJQGlCm+0ieejTxUznZh1pQEoTwInMVyJQTSttbloUVaULQoF0vKijHBQojyd0Dei/nCLWD5Fjh/b9STFnF7RKvEjRQdx6nAYQHfKQEBh/2sGueZ3AuPN0FdHjZ0IUIonFYaiRlm4HN9bUICVMRk0sn7rLPRTIuYaIwixY9PYboqRILuH4a48mEssfhXVg6xi/0Pb89AxCUiZyD3X4mBkOZ73dwy65f9F4npnOI6B06mUhoYTqGcJjUqu9/nrpNr18n5VG552rKriR/AHvNojjKk4zdF9HnGnv2FQg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ttzs8ufS22etmK50EpgJSE4wN/iE9HfXHRXCrWy3XBQ=; b=KO5wTcf5UpbYgtAEaPOzIBJ+GDwRIgaKbr8i/POw+RRUX8a0hhqwbdY+ae2o8Qf3Je09pJ0cWynArJzsvqp6KggZVZPOjX7s0yH6acsYAyKhugwprtOEZGB4Bhip4HoKMU5D7UDG6/wAmgFL7VW0SoPK9gPghPRdzAwu66BV9cTZpKejcXi2K0X4JB+tzGn4BntV3+XGjvSVI3cQ6WHj9IzWPKg8NdmILiV3faEfYn+pLAMZt61ZXHRDX1OEz0hQ+pSSpe4F1Qu4C1EVy8fdsFxElpPtSWTWPzlPn4Rp6ZVRTBdgrguAbyTkJZz8Ai4l6X8ECzdggqqjXY94sr8Ydw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ttzs8ufS22etmK50EpgJSE4wN/iE9HfXHRXCrWy3XBQ=; b=js5Qg++2rk/UjSU80OcrtbVAQmgTiwPnXXoPZ/mj3reSdfxpYBZnvUcks1kg2X/l18ltFPUsr7U8OqSTvdKAxdcY34hueeNyV8O7NM4yNU84Dihpi0f6pijNzpWBe6hJVBnQel1mdqNmNgVgGqe1wNVWZtrULiFzFvijxr6gMfCYptm3lSpCWj5ivDKhzNqqwp9SPw80rzOPOZJ+e+ZtwasETpjuyLicAJ11bEjIJBVzj9ziwtv3YuUXpI3PHM859sS3IsJR1GryzukcM46dKVf1GgZXqaCtXmdOl+5X/1AcY34FcOjxVdfq5H87sQDPROD6+iTtnCkDBFBB3gtevg== Received: from PH8PR02CA0012.namprd02.prod.outlook.com (2603:10b6:510:2d0::24) by DS5PPF7856D51FE.namprd12.prod.outlook.com (2603:10b6:f:fc00::654) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.7; Wed, 25 Mar 2026 19:01:31 +0000 Received: from CY4PEPF0000EE35.namprd05.prod.outlook.com (2603:10b6:510:2d0:cafe::d9) by PH8PR02CA0012.outlook.office365.com (2603:10b6:510:2d0::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Wed, 25 Mar 2026 19:01:31 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by CY4PEPF0000EE35.mail.protection.outlook.com (10.167.242.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Wed, 25 Mar 2026 19:01:30 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:01:06 -0700 Received: from rnnvmail202.nvidia.com (10.129.68.7) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 25 Mar 2026 12:01:06 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.7) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Wed, 25 Mar 2026 12:01:01 -0700 From: Edward Srouji Date: Wed, 25 Mar 2026 21:00:10 +0200 Subject: [PATCH rdma-next 10/10] RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260325-security-bug-fixes-v1-10-c8332981ad26@nvidia.com> References: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> In-Reply-To: <20260325-security-bug-fixes-v1-0-c8332981ad26@nvidia.com> To: Leon Romanovsky , Jason Gunthorpe , "Chiara Meiohas" , Dennis Dalessandro , Gal Pressman , Mark Bloch , Steve Wise , Mark Zhang , "Neta Ostrovsky" , Patrisious Haddad , "Doug Ledford" , Matan Barak , CC: , , "Edward Srouji" , Michael Guralnik , "Maher Sanalla" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774465211; l=5376; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=mXYcEoM+GTmJ2snXcoZtLt4npc49ENPVJTz16sL28kU=; b=ID8FbaQcaxZNqW00Npvz5lFivEhFUuufz2KE9QiJOZjDKcePJrVkYZez26q2TifuCVSDXpAUc UlZN3leqzWKD/URhNhBwr7LZMCQolzbYpPjwQ8tDyCKAIEH3Qs6oE/R X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000EE35:EE_|DS5PPF7856D51FE:EE_ X-MS-Office365-Filtering-Correlation-Id: 102a2583-8170-4033-d93a-08de8aa0eceb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|376014|36860700016|1800799024|921020|18002099003|22082099003|56012099003; X-Microsoft-Antispam-Message-Info: 7O9Pa0qoEnxhMSHK0C1PTQypwLVY8GObagTFMq3agZpv2qxFfbV/w0XxSaetYYwLxpZ/ufzwxTU+k+gUaHBsz/MtOnsjDWOVtGxXYusjEtNMd2DuyfGghUpQeniYXIBxiQ5I12/yP3ZeUPqlm90nAKAKNRRAUttshnLAcO261v3Z9A4i5P3Bs2Wkdbf7CE/UpmgOF79B+NoOkln4s4/xN8LV3D8JmTlytkGqFx+sJkh/RGZrBicG2RdxzcJStKLi+9aQP6YQYeOePq39fAbvsye8vUu/c/NOmm8fPa0JCQXCMMFYdNXvKFjdCht/NNzYNJ/+jxzvmOev7vTDGO0Vg/HIrmmnCg956hiORsiPvnBNPUqhzvgz5kEa7wB5iNMN5230d5EiRNvfrfe0nFYUEJAKbcDfCps7vmdal4DMgh4gmlIkByynEFi4wwGTJSSfrm102mksBiMQvQThn7eXm6CAnn8A4Q4/jAbtVM/eHhGhSEx6KKjWzm9NAtOYN1m9ah84cA5pdAP+8XZJ2CJPIRZmtY5EC/zN5e2eDnVX0pubAt9Bm6LbePzbbRZAWRNVag1Li2CsJ39oTSE+8LwlRvoty5677QEP8zSkU2MHizWb0QFmSrIbaLX56y85qwBooHX8ozGqrGp3xuSuWJhxLol2TjOG8NPvTrkAKqjP/+U9c7fXXciaZCg0fcy59AUv+tK1btRfUzxZwAyBMr6qe48nwTHoV5vNxbypVetN7fIX+ALWxgn4Ia9Ck/iWMavcJNwfemxSPoVxakISGT5un3VWuq5LObWUhUhXjz40ovnmSAVdQXze3wW8YuM5oBDv X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(376014)(36860700016)(1800799024)(921020)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: U/qqlHmXjIXDw8BVeDogd3NdJcv7W7wE3yedCTj0LUZtl1sCy5ERFv/3W2YD1MCiGVHf3ptBNkLrqAMd++fkHwBZ4dvCAUPc61c4JEF6BzBM7q+4ABHxK24DVcNsYAqUz5uuWVdhl/zWuW6viAmrFVYZjbqq4j7VfG/qRraD6bTyP01z5HJD3LzVHSyiQbWlOO54B/H/FfZRK43hCXXU/loZkTTQpubqKcpMnQLXVZA2pWU83c5uRY+qsYtv/GfMCjxB4HYPcJru+2xmRdEbkboplyyWZUxVU1iYhfuhq3f52X658TcYMiu8OTuhgKx3jNpZqPun8u4xd2jOmUnJtRzA8nsfNk58ArhwaElzx1LeqthdO8NUo3ebgQ1O6S6NdgksNTxEgRTEidnjZzNxd+BGNPQD5TCKIZ4UecZYVSXYWTImx0qn239nJJ+DXTfI X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Mar 2026 19:01:30.6156 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 102a2583-8170-4033-d93a-08de8aa0eceb X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EE35.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS5PPF7856D51FE From: Michael Guralnik Raw Packet QPs are unique in that they support separate send and receive queues, using 2 different user-provided buffers. They can also be created with one of the queues having size 0, allowing a send-only or receive-only QP. The Raw Packet RQ umem is created in the common user QP creation path, which allows zero-length queues. Add a later validation of the RQ umem in Raw Packet QP creation path when an RQ was requested. This prevents possible null-ptr dereference crashes, as seen in the below trace: Oops: general protection fault, probably for non-canonical address 0xdfff= fc0000000006: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 6 UID: 0 PID: 3539 Comm: raw_packet_umem Not tainted 6.19.0-rc1+ #16= 6 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6= ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:__mlx5_umem_find_best_quantized_pgoff+0x37/0x280 [mlx5_ib] Code: ff df 41 57 49 89 ff 41 56 41 55 41 89 d5 41 54 4d 89 cc 4c 8d 4f 3= 0 55 4c 89 ca 48 89 f5 53 48 c1 ea 03 48 89 cb 48 83 ec 18 <80> 3c 02 00 44= 89 04 24 0f 85 01 02 00 00 48 ba 00 00 00 00 00 fc RSP: 0018:ff1100013966f4e0 EFLAGS: 00010282 RAX: dffffc0000000000 RBX: 00000000ffffffc0 RCX: 00000000ffffffc0 RDX: 0000000000000006 RSI: 00000ffffffff000 RDI: 0000000000000000 RBP: 00000ffffffff000 R08: 0000000000000040 R09: 0000000000000030 R10: 0000000000000000 R11: 0000000000000000 R12: ff1100013966f648 R13: 0000000000000005 R14: ff1100013966f980 R15: 0000000000000000 FS: 00007fae6c82f740(0000) GS:ff11000898ba1000(0000) knlGS:0000000000000= 000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 000000010f96c005 CR4: 0000000000373eb0 Call Trace: create_qp+0x747d/0xc740 [mlx5_ib] ? is_module_address+0x18/0x110 ? _create_user_qp.constprop.0+0x18e0/0x18e0 [mlx5_ib] ? __module_address+0x49/0x210 ? is_module_address+0x68/0x110 ? static_obj+0x67/0x90 ? lockdep_init_map_type+0x58/0x200 mlx5_ib_create_qp+0xc85/0x2620 [mlx5_ib] ? find_held_lock+0x2b/0x80 ? create_qp+0xc740/0xc740 [mlx5_ib] ? lock_release+0xcb/0x260 ? lockdep_init_map_type+0x58/0x200 ? __init_swait_queue_head+0xcb/0x150 create_qp.part.0+0x558/0x7c0 [ib_core] ib_create_qp_user+0xa0/0x4f0 [ib_core] ? rdma_lookup_get_uobject+0x1e4/0x400 [ib_uverbs] create_qp+0xe4f/0x1d10 [ib_uverbs] ? ib_uverbs_rereg_mr+0xd40/0xd40 [ib_uverbs] ? ib_uverbs_cq_event_handler+0x120/0x120 [ib_uverbs] ? __might_fault+0x81/0x100 ? lock_release+0xcb/0x260 ? _copy_from_user+0x3e/0x90 ib_uverbs_create_qp+0x10a/0x150 [ib_uverbs] ? ib_uverbs_ex_create_qp+0xe0/0xe0 [ib_uverbs] ? __might_fault+0x81/0x100 ? lock_release+0xcb/0x260 ib_uverbs_write+0x7e5/0xc90 [ib_uverbs] ? uverbs_devnode+0xc0/0xc0 [ib_uverbs] ? lock_acquire+0xfa/0x2b0 ? find_held_lock+0x2b/0x80 ? finish_task_switch.isra.0+0x189/0x6c0 vfs_write+0x1c0/0xf70 ? lockdep_hardirqs_on_prepare+0xde/0x170 ? kernel_write+0x5a0/0x5a0 ? __switch_to+0x527/0xe60 ? __schedule+0x10a3/0x3950 ? io_schedule_timeout+0x110/0x110 ksys_write+0x170/0x1c0 ? __x64_sys_read+0xb0/0xb0 ? trace_hardirqs_off.part.0+0x4e/0xe0 do_syscall_64+0x70/0x1360 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fae6ca3118d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f= 7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff= ff 73 01 c3 48 8b 0d 5b cc 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe678ca308 EFLAGS: 00000213 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007ffe678ca448 RCX: 00007fae6ca3118d RDX: 0000000000000070 RSI: 0000200000000280 RDI: 0000000000000003 RBP: 00007ffe678ca320 R08: 00000000ffffffff R09: 00007fae6c8ec5b8 R10: 0000000000000064 R11: 0000000000000213 R12: 0000000000000001 R13: 0000000000000000 R14: 00007fae6cb71000 R15: 0000000000404df0 Modules linked in: mlx5_ib mlx5_fwctl mlx5_core bonding ip6_gre ip6_tunne= l tunnel6 ip_gre gre rdma_ucm ib_uverbs rdma_cm iw_cm ib_ipoib ib_cm ib_uma= d ib_core rpcsec_gss_krb5 auth_rpcgss oid_registry overlay nfnetlink zram z= smalloc fuse scsi_transport_iscsi [last unloaded: mlx5_core] ---[ end trace 0000000000000000 ]--- RIP: 0010:__mlx5_umem_find_best_quantized_pgoff+0x37/0x280 [mlx5_ib] Fixes: 0fb2ed66a14c ("IB/mlx5: Add create and destroy functionality for Raw= Packet QP") Signed-off-by: Michael Guralnik Reviewed-by: Maher Sanalla Signed-off-by: Edward Srouji --- drivers/infiniband/hw/mlx5/qp.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/q= p.c index c54e7655763844b10943e12a70431da291c58b8a..0663e1ca5465630ac25af646cdd= fb639ade18c04 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -1603,6 +1603,11 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *= dev, struct mlx5_ib_qp *qp, } =20 if (qp->rq.wqe_cnt) { + if (!rq->base.ubuffer.umem) { + err =3D -EINVAL; + goto err_destroy_sq; + } + rq->base.container_mibqp =3D qp; =20 if (qp->flags & IB_QP_CREATE_CVLAN_STRIPPING) --=20 2.49.0