From nobody Sat Jul 25 21:20:59 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013031.outbound.protection.outlook.com [40.93.196.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F8C938D40D; Mon, 13 Jul 2026 15:38:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.31 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957137; cv=fail; b=V2cMFWGAZFQZ9VpraGi/cOqsCP9JEJvg4KBXe9TpoTI6PKVWwPxAsxI1aMXRXf0+Gftkdm6kRHdEuRS9bPxMipVzd3xrOnPVrWBXuqXzHBmuM33j51sYgjMa74jj9k/Y3scs7sgT1BZ2FEiWQuWqIq2q7JMW7ztXA5V1b8giw5A= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957137; c=relaxed/simple; bh=bKivjUzM0g23lOmBD116hSY8WJi3eYKFOeneDCEWtus=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=ZQXqPGoOd56el+k2dsYfPQkX5FxbXuzPhbElxFDTTVwFyT2pzgYw9XtQKmjTr/3O3JCWw+KFqcZQCfFU3T9eTZbEQgm0cd2x60jHYTra1xPcCgzdgp7SBhXKB4d/5y0NDUHZaZ4onHaw2tu5nFQVoqT1hNv8JiwLxEQ/wptgUs4= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=OSwit6CY; arc=fail smtp.client-ip=40.93.196.31 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="OSwit6CY" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=doYnWE0bLMFvA/YkERfeT57vkH4luvlHQSXAfbAQ2FI7alZ0aomnRPZZ+UFcTPvUdji2kIwbEF9PzmJw9r/1Qn0FV3P/LDKsw/IWABhoCgH72SmH5IHJNJJR2M6CHe1MWD3KC0afLNyBt9KO/lsmB/tMVaf3QHzPCcEVuEywci9eV1LMevAbS4lhFa2DOX+y1IzHVhWMu9rcHSiSeiKydIgdSCSBgFERvtpy2hmgNyxT67WYigISEaXOaAeLw721zq8pQRTUokM2thz8Y1CQTbNRMT1I/Ilu0ayVhi9uHls6YssvAwEC0uM0/ahQcrtqww7Zd/FQws/9Z5VWND2zrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=50DUI5+fmglrMPplk6TKjghnc5ITV/0t5rR9Jq91HyE=; b=Cqm2CJ/pqyzsfl6jMo7Yu50xJtwtcKeLZGzwPkOW7+rviCxLoYcR+ptTsyTtNhABBtIO7WACUA3oJ2mfyzBCcYQyPsHphxu8vbqIqIZpwqtXcJUduGcCJbNtIW6b/CHIyiAZu7/4IDrGyvDG5ezoXUgLHXVmxmUzqh75LfjWcOV/pClyl3l9sNeobE44GayfR0kBpFy5j18C/G2tI7TT4LcSBmW4Mh0e+Io3A9Pd3tC8Kl7k2SSKIUcbIAmzJ0i2KI4T54uqz9vrW18EU2sTx4WWB+k9m6clfbW1tclNP1UptUqEXylGLNumAPQNSjP16sjjX8Iz1x2KXm0jRlgPag== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=50DUI5+fmglrMPplk6TKjghnc5ITV/0t5rR9Jq91HyE=; b=OSwit6CY6mZW8Rd+yovdaYVOTvyJ4nDpl+ZZ3Pm6VKptP1fI52nS9KgYlz1VtD/gFEa8qTpnf77a5jDz5uUZttlR0hWVPdWrOpoByGWOTpOOU78y3kWtIkI96RQ1EJ8xoR/7mPIw6QDt+1/FTzwyhvS0qq7feK5eroKj9X2REdKYzaL5NTozo7xZ1PiqqjW2OIBRKrbCpgWLKw/6AGFUM8amSGDJHJdERmdyrWJP6bn3MB5RlA0ts/V8ia8Ed8vUXlNOpNX9jZ13tB6izPeCZs5ETIeHflCYITQ/9vgcwrA0biq1XcEKZIllEZuihDGptp1KfoYQpqxOO7ZzfZzXYA== Received: from BLAPR03CA0153.namprd03.prod.outlook.com (2603:10b6:208:32f::19) by IA1PR12MB7710.namprd12.prod.outlook.com (2603:10b6:208:422::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Mon, 13 Jul 2026 15:38:34 +0000 Received: from BL02EPF0001A0FD.namprd03.prod.outlook.com (2603:10b6:208:32f:cafe::9f) by BLAPR03CA0153.outlook.office365.com (2603:10b6:208:32f::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 15:38:34 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL02EPF0001A0FD.mail.protection.outlook.com (10.167.242.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:38:34 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:14 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:14 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:10 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:00 +0300 Subject: [PATCH rdma-next v2 1/8] RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-1-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=8159; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=Fhd9ofQ4UhlctRydb08h40+6v+kEcr4Jn1BfnBNxazA=; b=QAWTL+9mIBH74xfF0At/CxRBBasITl9mAYj1+y/lkgkchKYNGXcfjlsiqyyG8Y815biYZOoKm uXU+exmFTJpBS9wgB4YMhw3Se9OgRDN1kRIVeb+TYrYy4ywWPSEAa3H X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FD:EE_|IA1PR12MB7710:EE_ X-MS-Office365-Filtering-Correlation-Id: 3804c46c-6ab3-4c7c-e0a0-08dee0f4ccc2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|36860700016|23010399003|376014|921020|18002099003|22082099003|6133799003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: ijwUSgscbNB4p+CHADRB9u4Rb+Z8sa3vESTtOv43NYxFlwgB7H4eUDTt6lMryfyufZzXzJ8WIib8n1bik6+0N/EO+PjrIjXVOXbe7ZtgknS5riZdFD6T0Xdeo3z7sGd7qMM9RjqWinKXHcCV790/zA+MEau8iNH+5DnIlh4ggpHEmIcA/B1VIflnJBEqYiAk6nQFo+ifhwyEqVuwIcFNSiP4+mU73hwJB2Wn6UGLvCeYHLsMFaBlY+hHrcdQxZYB7pxxgKQOk7tHKm2QRNbVHUlKKHfq31QbZGJ6m1sK5Xw7OER/t54F9C97ACL5UoEGo7RDiLkPv05STdo4V63xMwetPInz0IJDHu9smyWR0gICDnXZLsvrcQgfkIHo7zVpAsSdQ/a1hcE/Wj9oYP57FHTKHqSG83XXMPPFF5LjpLOM2wREnysdJF6cX6TgeT5VAl/DkWlLOUOimkCBajRPOVM8OEgcgXbxTqIakVB5ZsmyQBY9CThxe51jioIl19OFiPquQfY5L9kwxwwZ40E6xOJqeaA2JC1t6tU8JxZ8/ZmQt3bZNDkdeBZEJP4xay4V1z/wFKTtlHKJVGJGa49W3QhD3Oceu5r9glWgJBAiZSsLp71Y4CgI0xPJH3T5SskCqEsOtnSPA373/q2gJTxCjiG0ZxoeDMNX5qLJfSnGJ8FEXHs9iWXf9EFtr87X/lN+5spRlljyq/VDnMkbbtQLNIS8zrf3WIQhNrt/Y/pjhCbpWxbTvinyY1PIU9PHs0FL X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(36860700016)(23010399003)(376014)(921020)(18002099003)(22082099003)(6133799003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 26ZaMjC503HYnU5Y4v2sAN7AilcnC0s9MD6B4tvd07gj0qGe0HRGVzR/MGmksvPQgIVm8eSV1rw75LxEOHVlzhqoRac6VADLl3X+71/tpoxg78JADoHPVNFrn1XOWiCwwjU8BIRCBWkLQHIPH4pR9D+8HIWmT1Hoa210gkFs0KCC9t/0M9hwKCE3a0Y3yJDs5vnp/D5KCcJSuYVnXwgCU+M5RSCzHdG/JTIS+XX3dJhhHMfJeMQhkqMVD3Un7HunFq0MJJheiEvUEyfAGBBiJorsPI9OL9Z31FHYUCXIfiLLpZ6xQSw9kmZUTJa/VY+Z7xKJ4mYyk238neagW4+cZ7VhuaBj2vLpMGq1SM7dfAhNJERwCqN/0imCbOhk6RGzuwiAYIasdjRg4ANmJz8cTdXzONlDm7Se9DV160SkYunptc9FBznm9v537lDedoyP X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:38:34.3295 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 3804c46c-6ab3-4c7c-e0a0-08dee0f4ccc2 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FD.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR12MB7710 From: Patrisious Haddad Add rdma_restrack_abort_del(), rdma_restrack_begin_del() and rdma_restrack_commit_del() functions to allow deleting a resource from the xarray to effectively prevent future access to it and wait for all current users to finish while preserving its index in the xarray to allow to re-insert it if needed with guaranteed success. This is a preparatory change for subsequent patches in the series which will use these functions to fix the cleanup flow. Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/restrack.c | 165 +++++++++++++++++++++++++++++----= ---- drivers/infiniband/core/restrack.h | 3 + 2 files changed, 135 insertions(+), 33 deletions(-) diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/r= estrack.c index cfee2071586c16e3dfc4e21e5d58f8488dfb277f..0d7e40f63c8a00fe53441b3d2ff= 14ea5fd72e82b 100644 --- a/drivers/infiniband/core/restrack.c +++ b/drivers/infiniband/core/restrack.c @@ -129,6 +129,46 @@ static void rdma_restrack_attach_task(struct rdma_rest= rack_entry *res, res->user =3D true; } =20 +static struct rdma_restrack_root *res_to_rt(struct rdma_restrack_entry *re= s) +{ + struct ib_device *dev =3D res_to_dev(res); + + if (WARN_ON(!dev)) + return NULL; + + return &dev->res[res->type]; +} + +static void restrack_drain_res(struct rdma_restrack_root *rt, + struct rdma_restrack_entry *res) +{ + if (rt) { + struct rdma_restrack_entry *old; + + old =3D xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY, + GFP_KERNEL); + WARN_ON(old !=3D res); + } + + rdma_restrack_put(res); + wait_for_completion(&res->comp); +} + +static void restrack_restore_res(struct rdma_restrack_root *rt, + struct rdma_restrack_entry *res) +{ + reinit_completion(&res->comp); + kref_init(&res->kref); + + if (rt) { + struct rdma_restrack_entry *old; + + old =3D xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res, + GFP_KERNEL); + WARN_ON(old); + } +} + /** * rdma_restrack_set_name() - set the task for this resource * @res: resource entry @@ -177,22 +217,23 @@ void rdma_restrack_new(struct rdma_restrack_entry *re= s, EXPORT_SYMBOL(rdma_restrack_new); =20 /** - * rdma_restrack_add() - add object to the resource tracking database + * rdma_restrack_add() - add object to the resource tracking database. + * If this resource reuses an ID of a resource that was already destroyed + * after calling rdma_restrack_begin() but didn't yet call + * rdma_restrack_commit_del() it can result in an untracked QP. * @res: resource entry */ void rdma_restrack_add(struct rdma_restrack_entry *res) { - struct ib_device *dev =3D res_to_dev(res); struct rdma_restrack_root *rt; int ret =3D 0; =20 - if (!dev) - return; - if (res->no_track) goto out; =20 - rt =3D &dev->res[res->type]; + rt =3D res_to_rt(res); + if (!rt) + return; =20 if (res->type =3D=3D RDMA_RESTRACK_QP) { /* Special case to ensure that LQPN points to right QP */ @@ -229,6 +270,28 @@ void rdma_restrack_add(struct rdma_restrack_entry *res) } EXPORT_SYMBOL(rdma_restrack_add); =20 +/** + * rdma_restrack_abort_del() - re-add object to the resource tracking data= base + * it can only be used after rdma_restrack_begin_del(). + * @res: resource entry + */ +void rdma_restrack_abort_del(struct rdma_restrack_entry *res) +{ + struct rdma_restrack_root *rt =3D NULL; + + if (!res->valid) + return; + + if (!res->no_track) { + rt =3D res_to_rt(res); + if (!rt) + return; + } + + restrack_restore_res(rt, res); +} +EXPORT_SYMBOL(rdma_restrack_abort_del); + int __must_check rdma_restrack_get(struct rdma_restrack_entry *res) { return kref_get_unless_zero(&res->kref); @@ -265,7 +328,7 @@ static void restrack_release(struct kref *kref) struct rdma_restrack_entry *res; =20 res =3D container_of(kref, struct rdma_restrack_entry, kref); - if (res->task) { + if (res->task && !res->valid) { put_task_struct(res->task); res->task =3D NULL; } @@ -291,37 +354,20 @@ EXPORT_SYMBOL(rdma_restrack_put); */ void rdma_restrack_sync(struct rdma_restrack_entry *res) { - struct rdma_restrack_entry *old; struct rdma_restrack_root *rt; - struct task_struct *task; - struct ib_device *dev; =20 if (!res->valid || res->no_track) return; =20 - dev =3D res_to_dev(res); - if (WARN_ON(!dev)) + rt =3D res_to_rt(res); + if (!rt) return; =20 - rt =3D &dev->res[res->type]; if (WARN_ON(xa_get_mark(&rt->xa, res->id, RESTRACK_DD))) return; =20 - old =3D xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY, GFP_KERNEL); - if (WARN_ON(old !=3D res)) - return; - - task =3D res->task; - if (task) - get_task_struct(task); - rdma_restrack_put(res); - wait_for_completion(&res->comp); - reinit_completion(&res->comp); - if (task) - res->task =3D task; - kref_init(&res->kref); - - xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res, GFP_KERNEL); + restrack_drain_res(rt, res); + restrack_restore_res(rt, res); } EXPORT_SYMBOL(rdma_restrack_sync); =20 @@ -333,7 +379,6 @@ void rdma_restrack_del(struct rdma_restrack_entry *res) { struct rdma_restrack_entry *old; struct rdma_restrack_root *rt; - struct ib_device *dev; =20 if (!res->valid) { if (res->task) { @@ -346,12 +391,10 @@ void rdma_restrack_del(struct rdma_restrack_entry *re= s) if (res->no_track) goto out; =20 - dev =3D res_to_dev(res); - if (WARN_ON(!dev)) + rt =3D res_to_rt(res); + if (!rt) return; =20 - rt =3D &dev->res[res->type]; - old =3D xa_erase(&rt->xa, res->id); WARN_ON(old !=3D res); =20 @@ -359,5 +402,61 @@ void rdma_restrack_del(struct rdma_restrack_entry *res) res->valid =3D false; rdma_restrack_put(res); wait_for_completion(&res->comp); + if (res->task) { + put_task_struct(res->task); + res->task =3D NULL; + } } EXPORT_SYMBOL(rdma_restrack_del); + +/** + * rdma_restrack_begin_del() - invalidate the object from the resource tra= cking + * database but preserve its index in the array. + * Since this preserves the index in the array until rdma_restrack_commit_= del() + * is called, if rdma_restrack_add() is called in between with an old QP I= D it + * can result in an untracked QP. + * @res: resource entry + */ +void rdma_restrack_begin_del(struct rdma_restrack_entry *res) +{ + struct rdma_restrack_root *rt =3D NULL; + + if (!res->valid) + return; + + if (!res->no_track) { + rt =3D res_to_rt(res); + if (!rt) + return; + } + + restrack_drain_res(rt, res); +} +EXPORT_SYMBOL(rdma_restrack_begin_del); + +/** + * rdma_restrack_commit_del() - delete object from the resource tracking + * database and free the task. + * @res: resource entry + */ +void rdma_restrack_commit_del(struct rdma_restrack_entry *res) +{ + struct rdma_restrack_root *rt; + + if (!res->valid || res->no_track) + goto out; + + rt =3D res_to_rt(res); + if (!rt) + return; + + xa_erase(&rt->xa, res->id); + +out: + res->valid =3D false; + if (res->task) { + put_task_struct(res->task); + res->task =3D NULL; + } +} +EXPORT_SYMBOL(rdma_restrack_commit_del); diff --git a/drivers/infiniband/core/restrack.h b/drivers/infiniband/core/r= estrack.h index 75b8d1005a984b21896e296ac6ace1415a90905f..2df78e084e107c517a2468982ad= d74ce3562e5f2 100644 --- a/drivers/infiniband/core/restrack.h +++ b/drivers/infiniband/core/restrack.h @@ -26,8 +26,11 @@ struct rdma_restrack_root { int rdma_restrack_init(struct ib_device *dev); void rdma_restrack_clean(struct ib_device *dev); void rdma_restrack_add(struct rdma_restrack_entry *res); +void rdma_restrack_abort_del(struct rdma_restrack_entry *res); void rdma_restrack_del(struct rdma_restrack_entry *res); void rdma_restrack_sync(struct rdma_restrack_entry *res); +void rdma_restrack_begin_del(struct rdma_restrack_entry *res); +void rdma_restrack_commit_del(struct rdma_restrack_entry *res); void rdma_restrack_new(struct rdma_restrack_entry *res, enum rdma_restrack_type type); void rdma_restrack_set_name(struct rdma_restrack_entry *res, --=20 2.49.0 From nobody Sat Jul 25 21:20:59 2026 Received: from DM5PR21CU001.outbound.protection.outlook.com (mail-centralusazon11011009.outbound.protection.outlook.com [52.101.62.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8AF6E35202C; Mon, 13 Jul 2026 15:38:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.62.9 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957128; cv=fail; b=AmLgJZ1ZjLXMxOOkzWVQD6DKB4pfyb2UM0pa3FOFsBiWPyeL7H0Lj2L9aAJsS/2V00L0j+CMW7w0se/U6Q6Jb7fSZ6hnM+6eR3n9VkUm80ndoy/uPiR1Nk+n4QmHqskcAQ/u5oQCul78nU/+ASwTlxoeY7AvHc7JP8eUJlgNYzk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957128; c=relaxed/simple; bh=G68jvPrxfaFe5dtkodvNh+eeXGLL7jMijrT08XoMd4I=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=Zm0cQ4WS4uZuFzL8ikntyi3WEo/D1+Lws1u67uxXBF3eGtWRieZ25yERSouRmSmIjZGup8Y9FtDNLMDQ6vlPXk/0H53m9Ve979yuBfjF85C23dEyWZdz1Jd9A1A4H6XydMwkeArtf64qUGixa+Rypat6ANu1MfJ3bbVAz6auDZg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=sUBDUJ88; arc=fail smtp.client-ip=52.101.62.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="sUBDUJ88" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SeTtSqRPTfAlm7Ebgp+1S/sZ5X2ILr0CZ12WdaKmIf+FkzYMfYEXPPEZskcrHLoWxu1yjvg7V2cPQDyyJPp23+k8gxquMjnvj+QxdA17wqmZISFEWvEZIGIs8SWj+wT0QyeON+v7rjNkeG77UsWVEjETVwB2hUKqL2AGYP70Vx2tKQpPJmtivzWC3QPdyyVSTw+q4Ebu+AOdhacG8tmhW01TO2ivNB/gKSTCjiVpJ14/vs/oScQKkepIunhwLgHRTVT+BmL7rpZd5IV6A90zVqPBAoLE13klebIvdLhYYwkMl0k17xkHGrH5KTkrUceOqimSBXxjdMKKOIjLcv4WQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VKhqwm2DpU7bXnSgF+DhtmXjX3MaFczDF2arQ0aO+GM=; b=EOPW0RQ3DO+kXcp6Gfr6RrEq4WksnbsSW3eMPJTCv2Ap86/Bb7wIsIZbaQl0CfSOHhoobNI0EwlrujYKXJw7MplTxI5klNbxQdWTFvulcmDReDKa57vOIRDCW6Os6QngCDxS5NZjJHdzcmFB9+5mwuVWBBd+1UTqCVX5i0Z26oZQZfyvMRV2J9IGlEcGa0y+QP1bm4EaXeiqPK0KofWamCAfEV1sdNnQN3qPXZ4U82X1TBqUuwJ+tFuPDU6UJy3XAjl8iYviwx0ksAX8TgqhJ5cPnHHC15ty16xmW89ctTo+LrZDjAk5rCBc1dEAXN4UjGyF2oBA9QeIAZK2IVWeKQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VKhqwm2DpU7bXnSgF+DhtmXjX3MaFczDF2arQ0aO+GM=; b=sUBDUJ880qf1GU6ny4OgCq+UL0DssyU3GbYiULTl8/ZDN1SNvytxfnCMw+BmsD2sDEMP1yKSDpfAnixb3gEUs8SXys4sb/UmyIipQIfqL8hpCHdbBOuJ0p2ee7NpUXAckQegLA8ci58HKFfDm1R2oM+mzYkB7tsyJgUjLzvXzdI6xq3BzmGsaBZV5iYfkTOkh3Fca5vuddmbtMa4TtDBu7CYD1HD1eOs6yHsX2Wdg4QoTmNzXW6jTmaukbg3CNGVllOWf7N8nbDtdH7R4jTtUDsm/neE4PKmexOR24Wb+ZAmbM/p93mE0gFZZiOU0xOc4+byckm6Nla/ljeHhB65dQ== Received: from MN2PR03CA0017.namprd03.prod.outlook.com (2603:10b6:208:23a::22) by LV8PR12MB9449.namprd12.prod.outlook.com (2603:10b6:408:204::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Mon, 13 Jul 2026 15:38:40 +0000 Received: from BL02EPF0001A0FF.namprd03.prod.outlook.com (2603:10b6:208:23a:cafe::87) by MN2PR03CA0017.outlook.office365.com (2603:10b6:208:23a::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 15:38:39 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL02EPF0001A0FF.mail.protection.outlook.com (10.167.242.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:38:39 +0000 Received: from rnnvmail205.nvidia.com (10.129.68.10) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:19 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail205.nvidia.com (10.129.68.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:18 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:14 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:01 +0300 Subject: [PATCH rdma-next v2 2/8] RDMA/core: Fix use after free in ib_query_qp() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-2-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=4122; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=R+TRYIhig8ZnX7DJg94i7NQ/zE9FbJqiLhmVMgk6PbI=; b=rrRd1u/cSqO11//7Ps8QZ/8Ye7oOE0pKmdsRBGatqy33Z0si7+pLIv1E9MEHG+jAkpdWlfp1T JZngl4RQQREB5RlZ9Td8GB2uNA/fAFsF6/fXTUKhi4/4G21HSYgEhtU X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FF:EE_|LV8PR12MB9449:EE_ X-MS-Office365-Filtering-Correlation-Id: 41f26ee8-c247-41e6-525a-08dee0f4cfc5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|23010399003|1800799024|376014|36860700016|6133799003|56012099006|11063799006|921020|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: IEdJMb3Ly93MtsidSWx912coPidCj9oB0vEC7W9Shi+LNxU3o0cCBNLCob0Qgqgbd/AhDjqrEdIL/qaz1GJ4by29v2uIx1ZSz6ek9FzZZMbDynMtQfF74Z/4w5T7vyQlJYnhm1T1WmQTYirRjc2xLLSVLHmCev6ePPOuKXLnR4YrPrBstVV8UC2e+OK7C9ghirJM+RoprJ/W+gnQcVL1oO2IdtkWaweer2jaC9ARrHzy/seAtyTjxbnwHYqiXktYa9fE6qwN3a2lCDALOCHZfIxNzXQ9KBVp6OeNf/C8MppGm4pfMRMijWMgf6cBwNqSB93/q5M/PbRhZptki3v8VYBsW/cHAGxWN9IkZ8yohBFDPf6kgh//toqTUk95c3djn07Dh9PzlForRwvxFUVXg0nq7sZwPAHZmL9o9J+LoO235O7iCSF470bZCwb/o1rMQ20UdoZMQOeJabTQz9xOxtV7Ngy6MxjqtlroQhnL8nMscxBRc4uw3iDzr1H/BKOuqRD+oloiD4YrIUrbldnmDhkpGbv47vF8DS3rhQkmyPJqkNn6OL/z8NJNmLDgJfUQTcrtkKcgyI+pboCXyVMI+nDLRsbMV8hrJbJuwwXG3+ZwXSroEccLgJFs+cjIT5bxhAAHmnU+KvLXrYeav4of2+G72rmzBFkW2FPXfwdDKbU8FQvJ63un/I+8UxBBgNZKxBi0xOcOLPeZagoVFdQCDkEj7qJKbVhBJcZe2/y0T1OSNgWCCEvNWEsaUmwS8tkG X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(23010399003)(1800799024)(376014)(36860700016)(6133799003)(56012099006)(11063799006)(921020)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: NHkapIbrryDXDOoD/YAwuONGwc+jHR0dBUm7PZeKA2+i7P0SCcij2m0asIWVXS6lcP5QdtDvmpwS4gwT0H6ngHedzcOHngkr+KBK1/B7oK+TUib/7i6D9xDzf5aggLDjqvlCQf/bj2eV8eTQhkLnNRwkaWn7R2WyWEEPVUiGURP31DVnmO28BNCIzRftpTkoVAyLcdISciCu/gZbl/7tiBIGnPnaJYZPCZS5jledMABCVnfwbxr3rXfO9w+zg4ISrbpGFoZ519Jx7GY/bw6StWN4L1cz2/YcgUcPf+HpkoS74GUqJ4iRHc6KQWfKeWPY1t1gdqUMfdYYZpygRW3NdqcsoCzTSJVFhKO/UWcVtYH0RNMtoizuFdIpPUannRzkaq7USNlCuaGYoRilWR7NtC9RXCY+VXMwgJDLwZLvgFyJakaDSSYO4i2OSLt/beZa X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:38:39.3841 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 41f26ee8-c247-41e6-525a-08dee0f4cfc5 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FF.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8PR12MB9449 From: Patrisious Haddad When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdma_restrack_get(), meanwhile during the QP destroy path rdma_restrack_del() is called at the end of the ib_destroy_qp_user() function which is too late, since by then the vendor specific resources for said QP would already be destroyed, and till the rdma_restrack_del() is called this QP can still be accessed, which could cause the use after free below. Fix this by moving the rdma_restrack_begin_del() to the start of the ib_destroy_qp_user(), which in turn waits for all usages of the QP to be done then removes it from the database to prevent access to it while it is being destroyed. RIP: 0010:ib_query_qp+0x15/0x50 [ib_core] Code: 48 83 05 5d 8e b9 ff 01 eb b5 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f = 44 00 00 48 c7 46 40 00 00 00 00 48 c7 46 78 00 00 00 00 <48> 8b 07 48 8b 8= 0 88 01 00 00 48 85 c0 74 1a 48 83 05 54 91 b9 ff RSP: 0018:ff11000108a8f2f0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ff11000108a8f370 RCX: ff11000108a8f370 RDX: 0000000000000000 RSI: ff11000108a8f3d8 RDI: 0000000000000000 RBP: ff1100010de5a000 R08: 0000000000000e80 R09: 0000000000000004 R10: ff110001057a604c R11: 0000000000000000 R12: ff11000108a8f370 R13: ff110001090e8000 R14: 0000000000000000 R15: ff110001057a602c FS: 00007f2ffd8db6c0(0000) GS:ff110008dc90b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010b9a7004 CR4: 0000000000373eb0 Call Trace: mlx5_ib_gsi_query_qp+0x21/0x50 [mlx5_ib] mlx5_ib_query_qp+0x689/0x9d0 [mlx5_ib] ib_query_qp+0x35/0x50 [ib_core] fill_res_qp_entry_query.isra.0+0x47/0x280 [ib_core] ? __wake_up+0x40/0x50 ? netlink_broadcast_filtered+0x15a/0x550 ? kobject_uevent_env+0x562/0x710 ? ep_poll_callback+0x242/0x270 ? __nla_put+0xc/0x20 ? nla_put+0x28/0x40 ? nla_put_string+0x2e/0x40 [ib_core] fill_res_qp_entry+0x138/0x190 [ib_core] res_get_common_dumpit+0x4a5/0x800 [ib_core] ? fill_res_qp_entry_query.isra.0+0x280/0x280 [ib_core] nldev_res_get_qp_dumpit+0x1e/0x30 [ib_core] netlink_dump+0x16f/0x450 __netlink_dump_start+0x1ce/0x2e0 rdma_nl_rcv_msg+0x1d3/0x330 [ib_core] ? nldev_res_get_qp_raw_dumpit+0x30/0x30 [ib_core] rdma_nl_rcv_skb.constprop.0.isra.0+0x108/0x180 [ib_core] rdma_nl_rcv+0x12/0x20 [ib_core] netlink_unicast+0x255/0x380 ? __alloc_skb+0xfa/0x1e0 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x230 ? copy_msghdr_from_user+0xea/0x170 ___sys_sendmsg+0x7c/0xb0 ? __futex_wait+0x95/0xf0 ? __futex_wake_mark+0x40/0x40 ? futex_wait+0x67/0x100 ? futex_wake+0xac/0x1b0 __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xb90 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/verbs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index 3b613b57e269781e94e9d63ea75c7dcc46b1dacb..7abb89a4e6a019b965d36446d64= 609ed2c33d1c0 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -2154,6 +2154,8 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_ud= ata *udata) if (qp->real_qp !=3D qp) return __ib_destroy_shared_qp(qp); =20 + rdma_restrack_begin_del(&qp->res); + sec =3D qp->qp_sec; if (sec) ib_destroy_qp_security_begin(sec); @@ -2166,6 +2168,7 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_ud= ata *udata) if (ret) { if (sec) ib_destroy_qp_security_abort(sec); + rdma_restrack_abort_del(&qp->res); return ret; } =20 @@ -2178,7 +2181,7 @@ int ib_destroy_qp_user(struct ib_qp *qp, struct ib_ud= ata *udata) if (sec) ib_destroy_qp_security_end(sec); =20 - rdma_restrack_del(&qp->res); + rdma_restrack_commit_del(&qp->res); kfree(qp); return ret; } --=20 2.49.0 From nobody Sat Jul 25 21:20:59 2026 Received: from BN1PR04CU002.outbound.protection.outlook.com (mail-eastus2azon11010050.outbound.protection.outlook.com [52.101.56.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 89BF73DF00B; Mon, 13 Jul 2026 15:38:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.56.50 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957132; cv=fail; b=g+PL92ApI4TYMudq+EK7XhatF9verx61DGKJJx0tzGULZheDhunGrGgmv9NA+cYjhVmLx2NXwEq8iCbAZi47epEYup6qhAwmgCuQTYjvcZEPkYip0vn6SXkYw7JYjzIu/JCf4p0oBt0RDShnp4oUvfDvzlpUpl5gZ/nOrhraUHw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957132; c=relaxed/simple; bh=eDMhseWuOEgZ+n+3gA6lnopUnT0yII4WZ2zjPykid2k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=l6q2yjyyD1+akc3Pz2a7hXlG0dRGwcW6NPoln+VqHfFyRyn6sMj6H+7m1eYZxnYTc6ZOOmmxHA2n4ok+Cbq5y3GJtULqwyOSb0AmyqU4Ngnhj+cFsGwOr7NYvjIauW81qSiWpuNZeJcwc09dFA3uN4QjaHA4VzaAjHy6WEBFaEw= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=NAEyUTMK; arc=fail smtp.client-ip=52.101.56.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="NAEyUTMK" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=EVS/EaAf9MQZEqlHExkiJMy5MglW+6sWP+NwrCk8CodHYP0zE3okAdnbDbpfogvvSHRM395I+Owfzgp+zsRzd5aKjQh4wYoXMIpO+dobqBoN+HphOFuLU+JDCEPsT3cq5W/qdMImOl8wo+op3SlF4LV0rD2doPfhZ94Ew8k7fC3LKYm7+IcTjo2xg+WGTyh9aKb+1rJqqHrUnqQm/U8TFyfBD1qOP6fprRzzIW7sfrhe6nOUickVHuHk/N0mClO2iKfkO3KGaPexHK7uzPYAvJPjKTyONnBIa3dLW1NEFW1uJKsa24m9ofghng3iYMTypHYR81MrHOXUeGkXZ2CwGQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=YSsZlEr4sftCZO0An4cBC6NS6aCPmOAVGQFKHHs2o6k=; b=q9xZI95mgSztf7qAEx11jq3kTj+WEPlgirgLTyJo5DSITBkszeLknQjwcjGMXAqGy9LL38z/iXfB3tANdJ/FNMKMrRWPEEwkd9q9iLNAcoo9V+8ZhghD2Dv+dmppS6TccmXs/+BuXFKjVptGwsdQ6xrEeORIIWK6UoQHwZmHTJxGtO8HhlWPJy7MxBHNZHeiJvJU10vi8pRDm3b0650lCEx2VPfmhlr4sFgSP6hiIZMZ3dvXUMgOtWm8fia+BpPjPfX1afeKkGprTXnoCrSakAFwhKn0jyL0gmRa8+yf0f6T9ibb/iI4bjB8THeZcXV/IB4h8jUizMbExlsARl86uQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YSsZlEr4sftCZO0An4cBC6NS6aCPmOAVGQFKHHs2o6k=; b=NAEyUTMKSdpuElGSxjDCxB7TgT2CTdCHTHOLJJPlaCw5B5+56SXVsYZYD+dV0uzm8a4YQMU9QdMUgHP/DTxWJ/+PwnTbfOinAliaTUU8oMjg0UlqmEHV9soBdII17AJcL+6b0jr5TFBThH93/ySXdvOXnpXJmlIhL5NGyf99aW2Vq/xyxbBcIhq4f76xVhfNCfP13x/fwCFzttz6yJ2+5p/yMr5S/7AGRPo5kOOp3ymN4s3F3LOBSuTpRFOXQkiyNTT8wFM39P7iaUWjo1euzyC34j8dOo8RZfxK6hN+RSyAsjPyzHlgIurcTRqMom5RsVrLiSW4YRdotHUj9o5XVA== Received: from BN8PR04CA0045.namprd04.prod.outlook.com (2603:10b6:408:d4::19) by CY8PR12MB8313.namprd12.prod.outlook.com (2603:10b6:930:7d::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Mon, 13 Jul 2026 15:38:46 +0000 Received: from BL02EPF0001A100.namprd03.prod.outlook.com (2603:10b6:408:d4:cafe::1f) by BN8PR04CA0045.outlook.office365.com (2603:10b6:408:d4::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 15:38:44 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL02EPF0001A100.mail.protection.outlook.com (10.167.242.107) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:38:44 +0000 Received: from rnnvmail205.nvidia.com (10.129.68.10) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:24 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail205.nvidia.com (10.129.68.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:23 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:19 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:02 +0300 Subject: [PATCH rdma-next v2 3/8] RDMA/core: Fix potential use after free in ib_destroy_cq_user() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-3-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=2091; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=59+xBgMrEC1iEA9mz6DuYykfQTNa0ycMh8hgh3/0epM=; b=WFrGV9/TPdD4K2yDMu2FSTd7LMYbss5lyJKxBIoI33wPaaFfm5yHzaxgmYKmdzinKJ1DepJ28 44iuc1EG7+MDXqQyPHn+hIWWePvUqERFSP/5aEg21Wb4VkwNl1bHQNg X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A100:EE_|CY8PR12MB8313:EE_ X-MS-Office365-Filtering-Correlation-Id: a227a14e-71ef-4328-4f01-08dee0f4d28e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|36860700016|23010399003|376014|921020|18002099003|22082099003|6133799003|56012099006|11063799006|5023799004; X-Microsoft-Antispam-Message-Info: uM3kGmJZDjMS7iBujaC2XenpnKQQlLEamyYhtvzqMdgcUmMe43P+QwewPEm73flLGWH+zB0nu7Xe0x11oUsaPzOOZ9PdtyUi87aWfPmJmd0Og5yrVHEXDAO7M/0cHOvTDLQSs9j8FUJl5GStf5F07wElsfpNM00LDBXMlE+2jHx7HbQQCsPS/BaJn1gSriafiI8xGtdigA5zyxqcrlup9TyYR+tcG5mMnRkAKe7Hv38y8qbp/8T7XEAqoRvYsdbdo0ky1ZgFyo6zQyms85LkYkkYtdxgy/pFnkZxAzyZNB2eqPMtbhyadklUzMywd5CMtmx943uBr0kirEtwpQisUjRzoHii4NqeBU/joxmoJYGuFonxt4wpodwiLwQA0h2Vhapfq06+bPcR/1c9XvXjMq7/r/5QJxGrYFM4D2seDUpwF3pAScpqmm8oHsdZsMQvtxUrAwextBYijRo/EixxydkiS/LaCB460WGhwHCaMl6la0DjqniBzheFdvmILnshxUqxJeRuGrzp91hEVw3e0SYjQArTX3inCxY1V07wIiofp4Z2S5Gs3SkNiPZbeUoZz/XbCerWwY2fF3WhyNZ9A+na88kBifgRAfGUf+3BKWfQkoILGsxdrlqJtEKhn4DupcpIrSIHfY3uEuJjA+SUUQDQn73+O2IDrKiTNAgAbbIFnmg3ilt4OhXOsDGRcu37TDB/mlHzF1HkikINcPva37/Jc4fpmgYlHvgTkepi7aT1JsFYB7mqxbnrw9RVAL4P X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(36860700016)(23010399003)(376014)(921020)(18002099003)(22082099003)(6133799003)(56012099006)(11063799006)(5023799004);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: /SbThsMu0WQKbC1ZktgxwssBXui0ISLND3RkRCHVIyHoH1L++HvbgphP7FCfL+itEy0atxJFbtjjjC+HFDxAvSdCY6qLiU3TUiR9SBv0yIOW0jEhOd7gGEDpwNMclrL5UilRMkuCCPu6gLBHTrxj0G2Z9wpnDfhdeYe4Sdl7C+4miuYF5EUz7EoxpniXHCBVsS3adZNWBud4RGPEhFQ9ZXjTGYBNGYtcOtwZKZWacKTWacnYVDMSH4pEU5xsJuPSLuiEE9unJ3iEJiLlz+WQlzBSoEZYLpYM4K55TpvDlpeUN8Zc2HQYnAXDXlofP6xViCDVS1H/x2IKLuXevvuFupH611VrcRPkJ15+1/DzAKodby4vuGyl5ttjKXNA8fwKDBdcp2TSENB5uGA4SkboI5bJLEHeVUbg/3y8LiiRISdG5vdx2DffK28qoijm3qQQ X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:38:44.0358 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a227a14e-71ef-4328-4f01-08dee0f4d28e X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A100.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR12MB8313 From: Patrisious Haddad When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_cq_user(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of ib_destroy_cq_user(), ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable. Fixes: 08f294a1524b ("RDMA/core: Add resource tracking for create and destr= oy CQs") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index 7abb89a4e6a019b965d36446d64609ed2c33d1c0..568cb71da726a61997149e92aa5= 70e0bcb76926c 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -2247,11 +2247,15 @@ int ib_destroy_cq_user(struct ib_cq *cq, struct ib_= udata *udata) if (atomic_read(&cq->usecnt)) return -EBUSY; =20 + rdma_restrack_begin_del(&cq->res); + ret =3D cq->device->ops.destroy_cq(cq, udata); - if (ret) + if (ret) { + rdma_restrack_abort_del(&cq->res); return ret; + } =20 - rdma_restrack_del(&cq->res); + rdma_restrack_commit_del(&cq->res); kfree(cq); return ret; } --=20 2.49.0 From nobody Sat Jul 25 21:20:59 2026 Received: from DM5PR21CU001.outbound.protection.outlook.com (mail-centralusazon11011000.outbound.protection.outlook.com [52.101.62.0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB7063E00B5; Mon, 13 Jul 2026 15:38:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.62.0 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957137; cv=fail; b=busf6BdfkjrYZdZPndxMN7/5R72GUtcv2z/STJvH/LP8S/h56IJ7KKrVhe1L0Dn/qbiPM8MpAnepTAE0N+HSKAAG1Sn5blWyIU7OEkL4cCPk/TTwQnX0Q4pMCuJRWXa6O13V9c0qAJo96VmAM40vR20DDNiuVrHKF0cx/lKdvOU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957137; c=relaxed/simple; bh=8uPJeswScIvk9vRITO0KMN3ZS1M094TtFx3GodXuqow=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=ppYF5KyLjncTiqlXlUarZ6ZrCwc+9d4KNS1N8eUArT/pFgLoJTAmsWqGY069HY/7Q0+/qE/XHD0DfGLny00LvdA4eb4dcgIuJFN1L/aqQg+t2x+xDkhaq1QHeI+6dwv6GBDTwr5j2QFxp+i1krPUd/ZlDy4hsSyg9B03u1GBSSU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=D9Haqv60; arc=fail smtp.client-ip=52.101.62.0 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="D9Haqv60" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=husxM0F9e++s/m9pbFPE3xWqq3LxjK4CBt75ym3Hg2DkuM9iyW/pEWiMPG1X+qR5mhjok+kO6pbi/9+ZMO4X7ReRXIvngthbpdadkTpRzGrmJFo0iTfkm1cdl9fQrnJJLakzjmulfXcl9bl32M8rCcmZCDQBfmjlUijupaFNB3YkTLKS8y/k4S71yr6/2+TYQF8M6Nt5rwA/DlnWSaC4VGwKMURm9CxqYh6tR2yeAZg/Y9QSjMu43zzF67xIJfKpXvKYUjhKyAklzwULz5nX4675cXFmL2SUZPKgyWksAQ1LrNTI8Uv1AI1BpdhIbxawGdmU8IR8ILRUMlIZoIXofg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3w9bjwnNmBHrMM5/hUX8pplxLWIAxSVn0ZzPqjieNB0=; b=TXgLxhdilY66/9akw5Esl4tP2kzTC7HKwrsB7Y4nLdtOZ5Fm+FiNl/73KOv6wyXJaGZAA8os64VHZOBiSDRRggzeygVUrypWZJ8FO+lSVLplMYD0hoRUXii+C7UR4uZNzPUp9ovKOmDFBbCbJ1VbxFGSc0E/4BJH6KmjL90yxefMDTpfNeO/iA4uAQWaEH4bdpbb1e3WVhYWzAUG6NW9NJsm6WbDjWibHdy/sr4C3jJrC4+5ZZA+iMHd+hvtl4tyxVHAHCUTwgBhQ6rtnzCnMS6GBqXwaJh+YBflW4LkPXIlFfC4Q5As6x2IGbqtQS/j+GnIwJhAAm1ZEe7ONHEwQw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3w9bjwnNmBHrMM5/hUX8pplxLWIAxSVn0ZzPqjieNB0=; b=D9Haqv60L4ILfjYbV+eCHuzhCX0Mq76z/+D5Ln73cru0lfO97QbrGS7SfD2KRPfTONeyxx/Ohl8NTS4dE3LoqhMQz2yCzzMigLf5lL0yJm4mXzR2jWlUNZnBnxs18AzkPEN79V0d5OWssBTJ5U4NeW6PUfqQ4boCuoRj8sg3iNilIqkSL+qaIxxF84n/cuQpRZWg9YJhuZ87tvcYUyA0mi9A4VvfcZrE5FjiTBgv6qR7F/5dvrNYHYQISpfySNV0pmx+UHasX47WFQ+0+X3qMZsUuLefrJKKCMDLM4DNmQzZRY8ts8zIggNApU1tqL0WCDeydQewOCrQtzwdrzkrcQ== Received: from BY5PR04CA0016.namprd04.prod.outlook.com (2603:10b6:a03:1d0::26) by CY8PR12MB8067.namprd12.prod.outlook.com (2603:10b6:930:74::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Mon, 13 Jul 2026 15:38:47 +0000 Received: from SJ1PEPF00002314.namprd03.prod.outlook.com (2603:10b6:a03:1d0:cafe::14) by BY5PR04CA0016.outlook.office365.com (2603:10b6:a03:1d0::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 15:38:47 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by SJ1PEPF00002314.mail.protection.outlook.com (10.167.242.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:38:47 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:28 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:28 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:24 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:03 +0300 Subject: [PATCH rdma-next v2 4/8] RDMA/core: Fix potential use after free in ib_destroy_srq_user() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-4-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=2320; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=Jvu32SVgro+98Enzm7cCVvzDtkMapOP8jisNcoB1yCI=; b=L+JmEbZs0DAeSJZwgJyO2BXl8b6lYb6j0XXk+ynUg0uwSplD7k38KWxtOADLvN1uvnOofKJGW tU6q2HXcW4kDl1PmkNaepLB8Iew1PZfo6UXP5KWg6EF+UC3Fp6nUXPG X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ1PEPF00002314:EE_|CY8PR12MB8067:EE_ X-MS-Office365-Filtering-Correlation-Id: af335173-010c-480f-3ae0-08dee0f4d46a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|82310400026|36860700016|23010399003|22082099003|18002099003|11063799006|5023799004|56012099006|921020|6133799003; X-Microsoft-Antispam-Message-Info: 7PsRD3aVyF1ALp/W9XUNydz3yIBG8jlnUceu4O51CLpP3ULmByp4YcJ0Lw2aUwnseqDwa9GI3VGFGuPBRHSX6UdtzeRygeACLD2jUDr3k0n/qpTtUriok/cZFkIwqCkqnGSWB0dL4k24tIT4gkD1b/TZO31Qx95PQKxgvrd5wC4qDtjN4v1LwCO1Tuj+sEaXdD9k5TCC7epBlv1Bp95B20lGAJRG5ZrvLIbDte+brZG+Qv85WjlqcJ6nS3mNlB44I/C8H+gCwuJin4iHm6teVgUnRpd7/qc2qQl2mJNDtUBXp5vWT5zrMUPqy4JnXsxiVtO74gsmjcWSCTFr88i+u0S42iXRqSmBzvYJvoLwU9KrMuR9Wya3uvFAruErpc2dX47Z9+P2nH+gTDLzDEY12YJDBYW7YVTF5p0XZPRqzzrxS/6B3nb6IFTp2aH21VP7yMclAuNqyLxcSXpmENhCIU2BlrRQgSwLksRDRuwZiFIJsPU9syJpfwQFizF25d2VYB+UFF2RX+cbCsUy4AQHAwo+R2bfNJJbhVbEqJE36FjBnk7VIPww3w45xaN97oRnASHwg+nEDSMC4KBkpw35L6ic7SM1XKOp/kNcW4GhTXHcV30SidK4bVoDNw3n4XZiX2uvw2ER9H1wYLEzpmYYxzQ86NagmjP9Mlq/WNRzlMWP6NVPzK4dhAaSbV3z1VtKr2nnsECnJzWCrUxoJlvlyX5Elm6LymFVVBOO+fIRIrh7MuWf/b4p0YceymF9uRyL X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(1800799024)(82310400026)(36860700016)(23010399003)(22082099003)(18002099003)(11063799006)(5023799004)(56012099006)(921020)(6133799003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 9TgzBAGYxPMbXL9e0dP7Z2+RNzxiM8h9JAbqPLxK0rdNECNkFcVqxPAhtSk1z9JobLJsVBE0aVdTRskzmp0htGCXjNYGLD7RUX2R4IGlIgJ7t8pomgBKzcEN8H0eF6APp+SKsY6lzVdwHZh3B6omNhprY5YkKaLw/0a9gCoeOlRX/iaykTdnGFgwhnlldutrRIqtXfhFiDrajEt5P2HkX2ex7V0S7N7bsrv4NQsRvvKzZonCQkMlijcneKboSC1pCTvxhUX8oD5oAqE0Om1w3nRMW40EuKNSpjE+pYtHbSq4RW8T/UJbYOBEnMehCEzCG+bCTxqetBKRZSRsvgfH8YYKq0Aui/+vsmRmrG8pkk+Z3kgLjsw7XoEUENhnRWqmODN3/stgTyv3uMJrqLObrPTX54T+NzvZt0r4Nqe/PpqUaD/Z9ykDu5NO58bf843C X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:38:47.3274 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: af335173-010c-480f-3ae0-08dee0f4d46a X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SJ1PEPF00002314.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR12MB8067 From: Patrisious Haddad When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_destroy_srq_user(), which is too late, since by that point vendor-specific resources associated with the SRQ might already be freed. This can leave a short window where the SRQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of ib_destroy_srq_user(), ensuring that the SRQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a SRQ that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable. Fixes: 48f8a70e899f ("RDMA/restrack: Add support to get resource tracking f= or SRQ") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index 568cb71da726a61997149e92aa570e0bcb76926c..bfbc25dee95d031f91ffef5389e= 81faa08170719 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -1140,16 +1140,20 @@ int ib_destroy_srq_user(struct ib_srq *srq, struct = ib_udata *udata) if (atomic_read(&srq->usecnt)) return -EBUSY; =20 + rdma_restrack_begin_del(&srq->res); + ret =3D srq->device->ops.destroy_srq(srq, udata); - if (ret) + if (ret) { + rdma_restrack_abort_del(&srq->res); return ret; + } =20 atomic_dec(&srq->pd->usecnt); if (srq->srq_type =3D=3D IB_SRQT_XRC && srq->ext.xrc.xrcd) atomic_dec(&srq->ext.xrc.xrcd->usecnt); if (ib_srq_has_cq(srq->srq_type)) atomic_dec(&srq->ext.cq->usecnt); - rdma_restrack_del(&srq->res); + rdma_restrack_commit_del(&srq->res); kfree(srq); =20 return ret; --=20 2.49.0 From nobody Sat Jul 25 21:20:59 2026 Received: from PH8PR06CU001.outbound.protection.outlook.com (mail-westus3azon11012003.outbound.protection.outlook.com [40.107.209.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E0073DE44D; Mon, 13 Jul 2026 15:38:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.209.3 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957137; cv=fail; b=r0MX6+eTgeHuXf0L58uOY0kWuSGrlX44+iqR2Hsbo/HQJ1vEt6XDfKbwPu6bisoQ2/LLWGVMRqXQqcq1orAVbkEJjZGN2dRgauT9Z9vnMdvMt+aOR2GI9Oh2b7N+2qPhQzWg5JlSyeU39VncN6U9o3mBqYj03chFpaSP0uTGtnI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957137; c=relaxed/simple; bh=Vt9ZlM30PkQ1zNX1IBG1omQHLzQfl7o6PrRiDbYOzFM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=gaSamTSWOhqm4heyW/xupjGXmhQbfmwqvFNNoMbeqyIBCCns9nnei5rHeVLn9QiDXQOqldPeVZY21l1LzJvCDu71Ig4YgrSFb/k8/6SQMbYTCC1u6MvBoGQHE8tNUN226OR55OJXgw02P2yjv3tE09Pp98lJopaohjfMTuK5eyE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=BnR3jTrD; arc=fail smtp.client-ip=40.107.209.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="BnR3jTrD" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=TfUdoTRJ61JmnPn83lNhMC1qs7doFzE9N1PwiMlCRgGeIAsVFXGoJgmAXX1FnGGh7tMuT8x0EYOznI4S3AK0hkyU2YysRWTnlLkNZnp/x9gGX9VZvicmSb3lqDBKIqxuOq6EmHrTeJJuPdXItllXufSIFx1iG/aijRFFxU2Nv3u8G0YexOwraUwDDobKnqL+vktXgbfPwW0NT+FdlJwPTz9St7zOIktAjWuVN4uKNlARaIV8sKTxOH4QesKpsd2A1DT31AqlkFGv9QYowPkPgLc53B2sfYW5/xQ38hgdkT4CKgehWqKEfLRhSp+jtear2HYScMmf1BrYWaohINJE1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=383NTG1HYU1Jw0b2zygGl9BJ1U7FwiEB9NxcGHRbErw=; b=r90YttpSRGoGrDXxXeRf/m3Nk/yNb2kVqnKs7jvu1g3dTt7yUS9tg0Uj4/9iuOMMxbMnzmvZMydD1z7Max7jyFTtFduiWoi3e4CP7bQTgufw7B9z5s/ENF2C8nZA67S0CA0dkUyFVQpCdUGjVQRLxVlMjwI5R/RFouF71Ky+0qkNVgTr3Zzz8LzHJKTqPfGqMLkIxJHKqQmCVS8FP/NgU2puw6p76+IQUPh9jat3m6ex2Q2pNq56J8Oh3JQN1FbSaOs4RxvrEPEMLZQmuit9JXX/gsPYiCMUJqQ/QP3k7qkQnSGJMnNc6cCkf6MAHlIt1hh677gI62j8gOXrL72j0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=383NTG1HYU1Jw0b2zygGl9BJ1U7FwiEB9NxcGHRbErw=; b=BnR3jTrDKdRF9/9zPOxde0iFwf/hOAIaGDwW6sXL0xmoLuRg63aIooDpjrISGcLodG6b6ux7jlMLKwfe4g4UbiOPQ/cO6V27Zc4OBHAirIajLTdNiqMUryC3Xyn1hikZzt8RF0f9CmLFA2ou1NalCNcX8ppfufyey00zG+nm8nwInakZeboJLF58rNbJMdbO/g5VlEcDSG5YAH47fsgqB6lOr5IbubQUrcgpTF8FCSUgdzzJW7tiQIY2M9sGO4vYqaYVWZ3za0c8XmAze0/+6kXgny0rMoeikGYRYtHKX0C1nYbY9PgGHUxZ6+BtsuEki7lp7YOGVkYajilAyVcR7w== Received: from SJ0PR13CA0132.namprd13.prod.outlook.com (2603:10b6:a03:2c6::17) by SJ0PR12MB8140.namprd12.prod.outlook.com (2603:10b6:a03:4e3::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Mon, 13 Jul 2026 15:38:50 +0000 Received: from SJ1PEPF00002317.namprd03.prod.outlook.com (2603:10b6:a03:2c6:cafe::72) by SJ0PR13CA0132.outlook.office365.com (2603:10b6:a03:2c6::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:38:50 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by SJ1PEPF00002317.mail.protection.outlook.com (10.167.242.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:38:50 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:33 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:33 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:28 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:04 +0300 Subject: [PATCH rdma-next v2 5/8] RDMA/core: Fix potential use after free in counter_release() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-5-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=2228; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=oVEMYQlFUHAEGHJgNL4rGUdO0yTXkQAU4Dezp6h1Zzs=; b=fUbD9O4Q/YQtuB5caRrEuuLPDd/0F0IgL9wGp8/Q5STdHW5iHyvpt9c+3LJfgeZpbuIFWmKiV +nmw6Vo99xjCOEtVH7fUxBCgSTlewclUMiPXKVqcOtjNDULpk2Buscm X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ1PEPF00002317:EE_|SJ0PR12MB8140:EE_ X-MS-Office365-Filtering-Correlation-Id: 127385ea-e3bc-434b-3850-08dee0f4d68f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|36860700016|82310400026|921020|6133799003|11063799006|5023799004|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: p28pJGSJmIpPUqx6YkSb91x+RxO71GkYNKg7BqKdym1ML9pbI7AlW7pv7D4wP7p4EBufggJPp6llgc2S7FY7c9dzt2SAGwffYJpJqORFjpws3UvQpnFpzqNYyd093lNDVYJ2wbqh1KP8xOW23VdnbJBp0ffPr6KNiX638vZ5TiSb3cIVB6t2DG647jpiob4067sgfUCvcUpeVuPKyO99wppQG7xKFbnW6EwWZb0eePLPzY+OSPIp9W32wivthufBNzozldATXliWLymaA02WQPzM6sXtLbiSjrUYSiJR8PhqV20fjVtdUtgrwY13dl/Slx/Q2XeTryg/9Q0EIx3m1A6H39DCnWosFQXHKV+rxisxK1kcSEsd6p03j/lyty0y9N+4EIvoR9xosw8OdahbosakfC2SaSaLPCWsEH22KUzz+naWzm945r60DnmsMMGLXhRom9HX5kr9ecC6x77x2dQKDxz9d9WVxiCmLbuPGijBjXoHJ4JIWGMSybkMOUE5LzVQRulE7fp8Ebqp7wgZf9vG8TynZZ5vRK/yDf+LP7pDy/3xOuE3wHtlgQ1skMgTsBGc6vzjd7xUIp4L88povK60qtys/W69IfWjWDbu//N87Zn0YEgPfFAFGe1udmUmVS+2nilUwTCgeSDUuBYUIcWM/fxZUYkN5rrgCSAD4bmk6Jkpk1Zeg75dOQlg3HR2/LohqLouyP6jlvlnC8vKOjenBsY0R7aRLpPjx67TBMeBf58UfxpeQDfrCJZtkWtf X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(36860700016)(82310400026)(921020)(6133799003)(11063799006)(5023799004)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ja4eSVuDng3GdlBUcuOLmIIGbNvJV7iVxrbbnNm4Px8RkGkLosR7s/ZfwXU5AdLOiIcv/jMlcevY/qNmiaZmqCyUALet7JNQLHeNcdKk2KBsAbVQNImFDnIoWmTv0OlDfUFI5sh94MVNOANFBa3/aH4PQp2W99LMD22qw+rpg3qa0yB/mM+SfPtl2dS0FqqXUyCmpwW5fjUK6mN7BeOM0vIbibCFG9VxEcOUbHXEot6zQ+DokeiqkbkMG7/s9zSZ0cYupnhF81tnjkHKWoeZaP8vJtbzLAETtbgkvZZgRkTGMqcYKfSHiCtrHRw1vUFyRTtzrGW31ecvVOnydhjXFXE76kZ0cdGuHUYwpD9/MBzc+mQikVzsGtGYC7UQQlesdLMk59yhKrgHMW5pE4ZySd10W+MACboanZy0dfiJkqbYmhmNX2UqQc5W+8ToGtAC X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:38:50.9136 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 127385ea-e3bc-434b-3850-08dee0f4d68f X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SJ1PEPF00002317.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB8140 From: Patrisious Haddad When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of counter_release(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction. Fixes: 99fa331dc862 ("RDMA/counter: Add "auto" configuration mode support") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/counters.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/c= ounters.c index a9e189194c1300a37479502959ddc1d1687bd40e..a2c85840c501a74752973bcb314= 52da9aa2e84fa 100644 --- a/drivers/infiniband/core/counters.c +++ b/drivers/infiniband/core/counters.c @@ -234,7 +234,6 @@ static void rdma_counter_free(struct rdma_counter *coun= ter) =20 mutex_unlock(&port_counter->lock); =20 - rdma_restrack_del(&counter->res); rdma_free_hw_stats_struct(counter->stats); kfree(counter); } @@ -329,6 +328,7 @@ static void counter_release(struct kref *kref) =20 counter =3D container_of(kref, struct rdma_counter, kref); counter_history_stat_update(counter); + rdma_restrack_del(&counter->res); counter->device->ops.counter_dealloc(counter); rdma_counter_free(counter); } @@ -490,7 +490,8 @@ static struct rdma_counter *rdma_get_counter_by_id(stru= ct ib_device *dev, return NULL; =20 counter =3D container_of(res, struct rdma_counter, res); - kref_get(&counter->kref); + if (!kref_get_unless_zero(&counter->kref)) + counter =3D NULL; rdma_restrack_put(res); =20 return counter; --=20 2.49.0 From nobody Sat Jul 25 21:20:59 2026 Received: from CO1PR03CU002.outbound.protection.outlook.com (mail-westus2azon11010043.outbound.protection.outlook.com [52.101.46.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E456F3E00B5; Mon, 13 Jul 2026 15:39:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.46.43 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957143; cv=fail; b=JeIxxA920NuD0hqnxp1xXOI7uBvCrTF3WWD9vVMxNotdMShaqUNT+F6gtK+X7gFzayVJOq8w9ICTGZehOTE9KPoswuESrKRD8qbRpqWO7j/Z+8omDkORZsQBWHHKQPLm//wtgCOWQAbYUiaBFAMXmq2JjWc1J0Nbv4Jfz0wWtgc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957143; c=relaxed/simple; bh=b53RpVl+1C8TTbny6KsUgXj3XNbPDLR/ZJmClX/3egs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=cz7cjxXGpHq9NCUj/RUyf0bEvhKyRaRDqWgFBJ4x+yJSYLsCimRruBM6aMZqMfYiBmoXlgeSnGcN6aHIktgipn1jQBKOFkm1IRk7cIJrMISKge4DUwnxJDj2seUEazX8DaSOPQr8A6eN/cHfMeX0d2b31qh11p3q2ekukL4BPUk= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=YcQ1Hnf/; arc=fail smtp.client-ip=52.101.46.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="YcQ1Hnf/" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=D/AIsJgrZM0m79kqkll9ED/eD+B6vAycjlwmDzYeHaGS7d0coZMjeM+iIOdYs1pvsLWnKrZZEGAg1aoYGGs4ijxPN1dEjrosrnqN1nRRG3YdYTTSLHXRzENRUwncvi56uwZevxuqLXj/HFoEMTBo8va08iW5zSWzyevXNlXA7FYXkz5Vf6nxNOMZSQgVNomQNc3sFd/8NbxNaUMXR0+WO2FYp2ZaGc52KjDTdI6C2nhhJptB1h2s7DKXVFGeAkOx1UXs5skrkD9svNsVEhJShdp6j0QpFzmygpwO+N6kDnZtizUI10krFYDCWW/DB/ZOyREbf3lx7O2xHhuBg9DLWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=beiZqJ/73+OyiMxfmnzvnXSZyEb8uZjZFfAVrMxnp5Q=; b=WafaW0iY1tHScj7AqzZx9NmJh7xUcxLwCXUu8qQJiJAYzIM1nnT3XMDgXixXzPGVLi0cQVhBMknwc52mzGx1/9EuxXYZGggCUyKqhYSMzpdFaL2xQXxnDqe/uTzlxa/Yfwc6FpORffXPmkrfvS3EqpJIbxC0MR+VSBPfIntyIUrrFRRXD0pHNJSRd4YOmbOx5mN24rwWrJ4zqCWdO5FFLssrM85VA6ahEieghohAysAkuHVqQaRztNyYYwtdlx1Bx9XNjUya3WO7mm0lAm1vR9lJOTXe+TAwo/61P0+qMdTBV0TmLrbZQaBZyQ3yAuKzMRzWgWY7KfoXuZilJ1hncg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=beiZqJ/73+OyiMxfmnzvnXSZyEb8uZjZFfAVrMxnp5Q=; b=YcQ1Hnf/Ux1ZOVtSTODn3U6GWqlquAVY+tItIojf4RH/HbXRw9IVeztr6gPHd9XOasWKyYzAf4H2KTeklP7NMoEuSbj5/mgQfg6UcKBng3/8l/a8tkHQjZeFRwP/rp/F772PxIMsXqIGxXYgodzXa6a/tRD62u/zQQyJhqQpG7qi0SNlC017DRDdIef36+soKZbu98fApxQ3Izsax90pTwLrGa0Cd8eYng9HPteh0eAmQGheHOU4w0B7t3+ok3HiSKKur1S6A2lG5063utRBzo+1XAwKlrjUHrKc4n8u0UsQJjqaUVMLFysHbsKSt7inOHuIxB3RYo2np5DLjKKXoQ== Received: from MW4PR03CA0033.namprd03.prod.outlook.com (2603:10b6:303:8e::8) by CHAPR12MB999250.namprd12.prod.outlook.com (2603:10b6:610:300::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Mon, 13 Jul 2026 15:38:57 +0000 Received: from SJ1PEPF00002315.namprd03.prod.outlook.com (2603:10b6:303:8e:cafe::55) by MW4PR03CA0033.outlook.office365.com (2603:10b6:303:8e::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 15:38:57 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by SJ1PEPF00002315.mail.protection.outlook.com (10.167.242.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:38:57 +0000 Received: from rnnvmail205.nvidia.com (10.129.68.10) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:38 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail205.nvidia.com (10.129.68.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:37 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:33 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:05 +0300 Subject: [PATCH rdma-next v2 6/8] RDMA/core: Fix potential use after free in ib_free_cq() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-6-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=1814; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=HX23mOgsyaK+lgHvElNXf0sQuYVHYh+GHhlZjiNNlVw=; b=GgsSvbK6ANcSiwnG58t2GPF188CMDLGz1zR103d6fQz/rrvF1O9mRgXkuAWdRXpAdznV2rFsv zdiNLfr7e1nD42LL84Z5nCa5Tig7wqbvBVGTtNDXWmDoNDfTZcsvG4/ X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ1PEPF00002315:EE_|CHAPR12MB999250:EE_ X-MS-Office365-Filtering-Correlation-Id: 1aad7b5a-94c9-47f6-66f5-08dee0f4da60 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|36860700016|376014|23010399003|22082099003|18002099003|921020|6133799003|5023799004|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: 0japJunHpb/O95XRY8QJ35M27kQO7rCUzIucTEesle2J9X5hw/09AS9/kCOWqPKQMX3AJF3AiuJYPDoyhDo6r3KCxr91vLVcF7bKb0jXl568GJm5BPkRt6F4X0+Z4PyH2P7wEiGmmN6OvxZ2tOdFvjCSQNaNiLfWflF5MMQnBwgedoZv6GiswenSfMWgEoFtj15uim3XoBcmleH3FGvsCS3hVXgoWpVs+RNo/DUw/ttEF8gI/+okHQJ5TdVaPkYQmMbRSAk+TIC8xFA2EmqFSCFTqPGDap5WTHO0iU7Qojig0cOXWskTWBtIxSIqK5ztUDnhmxkuK1sBlZvfdu83dEgxM3tLKQl4jj3yUQpqRdA+4Hfj3iRHID/DKZgcU7LOolflBgJJkzoQdyyaa+dmKFk8rcJH7KLt5vwY8QppRBsfbrnYZDQrl4EE8gqJF4EH56ChAl1/92tVZdAi4fggVFS7WHcM7esND3CwFgFVeMPbRuC2I3fKbiCGYuBgYmLtO6+sN9MkkrRJPOSc67q9YRVvT6PBVMr1ahbv5YOdeMRjymJhfTFL0aa2NDhwSEI3EivNXb1vlzhwFhix0J195o1BCWh4PDC3SHxlfo+oBY+7kHdTVRMvByeJ4wuONKwBY4+rSv1mPf3oiTwW8IeZ5QAYydq43BckWL3vaa2WYT8VE7lfUeHDuw+A886Kxltwf2qd57oSxdlbX1WgYgMLD7Ki7AHeWcrUTab4IpnuRdKAHsI6jS5kuVYXjtLxnDZ8 X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(36860700016)(376014)(23010399003)(22082099003)(18002099003)(921020)(6133799003)(5023799004)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: juQ0zRzEKl2ebGtjCeLra02q3RZtGMS3YbF/53Q42wmmNeJHWoNNB9PaZ5i882FZ/1fgD8W9fAGgCByifa7PFZPX2nAeEnWdtByH6j0f1CJ5TPipj1dMnIG3JeCPGOzwaAfXlNPn5gXwvNOeTye8ffd2SP5SLttenSqgjK1TJVwcXQwdc9h3DNsG65Sy3RTnw1u8WwRC6tNxZB2ya3Ki37x4p1RoJIkQti1DAIFycHc75MsMsGtrL0Z15yjPdCo/sfVIOa1kNKGua16telPmGkgHIBygDmkOe8wT83Yg1AP3Ckhfgl7b8xwttf+noufHI7uv+UH7gr8cIWhCqU5ufkzpNzbxpiaAYUhfBJS4sKbQZzGUDyCrbkzhKtAyQuvb+nlCst4bniUjIhdmkkgzK+ltMf2fe5HJftKlRAErWTnFxLZU0WR/vPTQ423sqpac X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:38:57.3306 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 1aad7b5a-94c9-47f6-66f5-08dee0f4da60 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SJ1PEPF00002315.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CHAPR12MB999250 From: Patrisious Haddad When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_free_cq(), which is too late, since by that point vendor-specific resources associated with the CQ might already be freed. This can leave a short window where the CQ remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources ensuring that the CQ is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a CQ that is in the process of destruction. Fixes: 43d781b9fa56 ("RDMA: Allow fail of destroy CQ") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/cq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c index 3d7b6cddd131c4ed07082719fc9e3b4bfdb51459..1379808e1404096654e8dc73a11= f90d939910e54 100644 --- a/drivers/infiniband/core/cq.c +++ b/drivers/infiniband/core/cq.c @@ -327,6 +327,7 @@ void ib_free_cq(struct ib_cq *cq) if (WARN_ON_ONCE(cq->cqe_used)) return; =20 + rdma_restrack_del(&cq->res); if (cq->device->ops.pre_destroy_cq) { ret =3D cq->device->ops.pre_destroy_cq(cq); WARN_ONCE(ret, "Disable of kernel CQ shouldn't fail"); @@ -353,7 +354,6 @@ void ib_free_cq(struct ib_cq *cq) else ret =3D cq->device->ops.destroy_cq(cq, NULL); WARN_ONCE(ret, "Destroy of kernel CQ shouldn't fail"); - rdma_restrack_del(&cq->res); kfree(cq->wc); kfree(cq); } --=20 2.49.0 From nobody Sat Jul 25 21:20:59 2026 Received: from PH0PR06CU001.outbound.protection.outlook.com (mail-westus3azon11011007.outbound.protection.outlook.com [40.107.208.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B6A773438B5; Mon, 13 Jul 2026 15:39:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.208.7 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957155; cv=fail; b=EkmpHRAMDcZ4+1XxPaU9Xs53lPWkgTDFH7/pgx8H24DEcnBOamVos4Ti9mxmRB2FtwynQ0sDiJAfyc117k4ZMvtpvjLOAHIqLdmx/v1DrgBC48ULvJ/s3h2+69dkeXCs1R6dLuDK/Z7eHt0X84xygakHUYzim03CQXvVqPOAUO4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957155; c=relaxed/simple; bh=hA2VJL3RZwKxjNTnbiXcxJeYvN4ELggcsOWBeNCT0vs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=E4Po2FA1j7E03yb7X4g0VIHtRfbFOT0gLJFzEACPmJSowemvZ2NNyADeZ1Rxjzrghr8JEl/GYHZPZPHQu6VdwbURgErLZWEEq9J972gNd5/OFHOew5uKIyDtqtDeVcvJZiaKfohJVXVK/kVD1ACu9fYgdu5bjOqoaEYgcjCs/Ow= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=TplwMCNy; arc=fail smtp.client-ip=40.107.208.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="TplwMCNy" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jIioQvmrKHF9Z3+cyW7UntZpWpmn0g0Gn+TbLFklfvki9dxZ90QzthFUvW0usXwvUfUhk0HjvdM5e9bL38shnYaBQIdsWPvakudH4SCmolbf16Xtv2a/Gk57WnmHsNz1M9ZwpTg3sv6UgahfjeviCwdwq5185hNunHHLuoysoQboSkg9TDbTELE7/A7Oqm/19KQTj+ajMhWB2A8WhY59IdnYytloWckuA0i/yQiUT039DdREEBrY0Xi1fBlziWcqM3m5ca8wpim41ahP0REsLhQw1CRs1/DeDRe97zXf0V9R6yxm6Rhyg6fNzAhXWsdmWk2uMeGrLfm3MIIPqc04pA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FhyXlNpxtutvAXD8ugD9MHCzHPZTE8kCEVlPnR6VyuA=; b=Qy3u1AOQ/1vXq0V6JZOQi7QgACKNJq2drL4/nTHcSILllXfiWCTBl8bLCYE/Ke8YgYWo4QHniYSrbJ5PsAM9Rg1yqE/znpW83skb1caUIOFC0IKmk8mXpdnVQwTUVK7fBg9E6bjjqguGZx4bVhdNpbI77BbJhu3PGchgh8Of/bnHFdZrXwYZ3Sd+DzzakIpWAfHQAU+TcSYf1fRIVbICQssax2Ddh1uQoCbL15V7WpaV2PJ5I7ODKwN6mM/CY5mX63p2opcSprjDhZ4TNsgPLHHOp0nI9EgpSpt2eL3YpHks4h7rz8Cf3yjLwyzfMWFHvEbaxJpbo7jJ2P/AICLU6A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FhyXlNpxtutvAXD8ugD9MHCzHPZTE8kCEVlPnR6VyuA=; b=TplwMCNyPm4syxhVMvXUWTJYwCnu1WE6P6/Kg34fdk76yyd5co9x7b0vFKiOTVPuLAtKoOS1VKJ+D1SR40eILzH4gxIaFm6w/M37JIe4a/meVN8jFHuOT2Cf3R3Rukn9Lnvz/WOmHXM/kjrYmDar5VZzyDpK0XGVpEW6pkBnOiRf9TNUqYOTETqmp2oYnH0zn+7CRkPSoe7z8mVQnIyEQxOZdlZDA6RGMTYKRlQKHM3EgFx+40RbMfCg3fc2V0L44HlKirhCnHuqw8x7bhimG4e/0FDPoUjpVtXL7TJNqmizlMZE2jH4csKpAIP+8ua42eWgbmuD4S8b03JP3ap6jg== Received: from MN2PR03CA0024.namprd03.prod.outlook.com (2603:10b6:208:23a::29) by BL1PR12MB5730.namprd12.prod.outlook.com (2603:10b6:208:385::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Mon, 13 Jul 2026 15:39:04 +0000 Received: from BL02EPF0001A0FF.namprd03.prod.outlook.com (2603:10b6:208:23a:cafe::16) by MN2PR03CA0024.outlook.office365.com (2603:10b6:208:23a::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 15:39:04 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL02EPF0001A0FF.mail.protection.outlook.com (10.167.242.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:39:04 +0000 Received: from rnnvmail205.nvidia.com (10.129.68.10) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:42 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail205.nvidia.com (10.129.68.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:42 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:38 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:06 +0300 Subject: [PATCH rdma-next v2 7/8] RDMA/core: Fix potential use after free in uverbs_free_dmah() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-7-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=2177; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=Eg9C505NCnlykfgzHCbIan3jypwLn/hzfWIj6xB190s=; b=KeC9BsBP6IiZr0dX79rXIPvDoXCk7sbDkzngGb0dW5U8/a1+1JIxBEM+GyfFKVsU/BzPtb3ta TryJfPFhtTCCe18PxYqFOcgmx7NtyiM4jkBnFGl5XuNR2JZQj6LvYKs X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FF:EE_|BL1PR12MB5730:EE_ X-MS-Office365-Filtering-Correlation-Id: 72b5f455-5fb6-4951-9a90-08dee0f4deb5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|36860700016|376014|82310400026|23010399003|921020|22082099003|18002099003|6133799003|56012099006|5023799004|11063799006; X-Microsoft-Antispam-Message-Info: Ezx8Xefy+PEGD/CMFpCjUD0RulAq8hJE0GIpW2g1L674QFxhGrgOTw1HrHj/4YcLWtBodF5ckfS5faWM/qTPke5q3ed7C5a+a9zTWymc9TRT/sqG1Oz8pCaXqHzX5UKQ88rhZHHxksSTcHc66BRbHZEMWw1i/5qjjxO7JddwIFTvlzMrXF5Av9OzkBLtOILkDLdyIc5Mt2IiTvciLm//oPXUKnef3m0IeX5JH5hhSOA/zWiZaw5Zioal7TYyJPjoGkiynJ35LUJsA2cvc1ZTWoX7SDy3HdjhmAJjX5ngwde1OSvNcNDakhhiZ48PWxQLdhsrllsMqN2VD8JXLQZLtm38xfgq+BurM7+y7FEi+AHCJzgflzaeIT/NXDm+laLY2pGA1aogVpqcq7k8X0jO5sUUco4wAICenmJDxeVTJiFxlSti5Kn8pvQae6o5Qni3zjFpmw9wnXQrmwJsX5Qiakw2zBkcB/jzw+PKu3il4rPSW/LcB7KD9jdJxO3HADWnGT1fwHsK7LOhcJj8O76EVxaYlBE6BS1Y7QSTtpTxK0JHCw2k5ut599XXGgPcq5CCP8POlZztok7t8Z761uSIcQFAOqnWv5v6hdjN+2C4C6To3HqoYzHv1T3PvtYV7QZLjqIqeNiohgRqB3ngfbYApHTIFR2433yjStOYs1/XgX4Yv+bKNRc2JJCbXu+4WmWPUIZnufxllLLcEUO3fVrCzD/umrAGXe1X37fH5jzBxAD/GsvrV1VNoasB2I1BCsEC X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(36860700016)(376014)(82310400026)(23010399003)(921020)(22082099003)(18002099003)(6133799003)(56012099006)(5023799004)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 85znkHFtRcRY0I6uRm8IXh1OK2YN/VgZWtEeUH7WO7YxtaXtnvuw+oaASpGdgGLq1etJ2vxftKRTf/4SwmlblzA0iMiUUs7ulAqCRlyeTP3749fteBd+NBWqJr30tI2l5YYqB+VfX06m1Nien/2RLZvq//paNgowEdmoeRC7SPB36N7l6bheu67jHHoJDpp/FpOkZrDwZUOT+yX+lht7POXJZ1XlN4WMsZpWSCPEBuudM9VCZH/6uLFGVR3wmMsszvdrRSmGTJR8AP63eZ3Nwy7Gwedt8qtfhw2oVDUqxXPf3NveSj0Zj6OsI9qQkrF69K5kt5Kpeb8F1HK/3EwGtWsTWUjpimZnpQjPTB2U66yqtvcWLf3ZiLL67Rh7uGSYg62BkYG8EpMLj8JX5VK3y781+sW94NZw+t9SJBt3fFWO1nbBC05Z7BYJivjVVfKb X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:39:04.4478 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 72b5f455-5fb6-4951-9a90-08dee0f4deb5 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FF.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5730 From: Patrisious Haddad When accessing a dmah via the netlink path the only synchronization mechanism for the said dmah is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of uverbs_free_dmah(), which is too late, since by that point vendor-specific resources associated with the dmah might already be freed. This can leave a short window where the dmah remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of uverbs_free_dmah(), ensuring that the dmah is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a dmah that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable. Fixes: d83edab562a4 ("RDMA/core: Introduce a DMAH object and its alloc/free= APIs") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/uverbs_std_types_dmah.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/uverbs_std_types_dmah.c b/drivers/infi= niband/core/uverbs_std_types_dmah.c index 97101e0938263d114d6c1e398895bb8335915202..9873ab49a60132ce32891b96909= c1dbfc383fe60 100644 --- a/drivers/infiniband/core/uverbs_std_types_dmah.c +++ b/drivers/infiniband/core/uverbs_std_types_dmah.c @@ -18,11 +18,14 @@ static int uverbs_free_dmah(struct ib_uobject *uobject, if (atomic_read(&dmah->usecnt)) return -EBUSY; =20 + rdma_restrack_begin_del(&dmah->res); ret =3D dmah->device->ops.dealloc_dmah(dmah, attrs); - if (ret) + if (ret) { + rdma_restrack_abort_del(&dmah->res); return ret; + } =20 - rdma_restrack_del(&dmah->res); + rdma_restrack_commit_del(&dmah->res); kfree(dmah); return 0; } --=20 2.49.0 From nobody Sat Jul 25 21:20:59 2026 Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11012005.outbound.protection.outlook.com [40.107.200.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 073323438B5; Mon, 13 Jul 2026 15:39:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.200.5 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957166; cv=fail; b=rc5pmxvWlgJeRo9GSt/8p9IYksiMh4IyptTmlGjIqJ3Jdit+NjMvYyNb1GxQs3kE27v0EX+X/voeiPrwYOkEKUc0CYcU5K8vc5svCMW2hshuKBxHTo0wC4IPWN+ApJxF31r+6TIktYcAH5bltf4ilMnMO2wYrtepgOlevydY4hI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957166; c=relaxed/simple; bh=Kzyvzhrg35Mh+93QsdS16TxKMgJDgSrwHhCXnx6ejCU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=gkz2F+RwdlzcppRm+VQQ7vo2O1FBcCHhcCNqWuJ7zTtpGx15YDQNSPnMYxVF85jYRaKtEMeTdXTxpcGjhYNcsNjjAdOs0eUFbxdXSnDk+1KRaiZQo8sN82autfxGaH3H/8DQINPL2HvKeClXsZ4Ksaeep3ykVHfj/2B6vSjQq1A= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=PannYXlF; arc=fail smtp.client-ip=40.107.200.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="PannYXlF" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=V/o7RfZh5wdUENy9G4PXrPc1pRvdrAqFnh8gNyz2IkP+6wOu8NzwruiaLavcDXXhctapeio3EOOxRGDqnHPk9nlPSFTGCjwZvCGWHF0eiwVMlknchRTq/7Tkow2MwB/CUvriQ2GaU3aratob5kAedCmV/Cvo6kUzqm1CdPLUzKFU6ILxEfrL3ZSfAS6kLrOuWVo4NOIiHSUB1bLT/wAQr9CMhfIXFWIOkW4iTnxpGcNO+VQbaKXPPdETxcKqzwsyAJUYkTZpLaLHyD/jD0bidxhEd9pspCCfUw5CVSBK2ieLFHiQMqRfxj7SDGTQaXVapYwyOqPUk2lnLXi1l/gYXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BDlKlhWEMI7JrKVX2pBamKwIKRZzhaSZ8J4Z7tjyPyM=; b=NBPm40QtAbirtu0PFgnPR3nGTUc2JK9vQ39ExKzNOL48zm9PqbpDF2ssnA2NP2mhOSHw5TlS62/wNo4kF9YlftD+FvgbVUN+n0l3Bnzl3PLnosh47xZTyj8vBULLB/vYqzV03yoi8x6r8kyKmEG688mqPXXh67NBjISRr6azdLSUyLFxDIAzgD7HhOq9kpwYEH4ggw7SGSCRRFOtfC2fxxw3yQW2AMs6BHm/BQ96eA4JG4cFdTmRCgAiVqgYj+5N84MtZ5OLFbTjvr/2hBN95MhtmMkbzlV5Uwybkg4k5dzaLusTHkzCh0nbk/82DQMLO3UClKEgGIQbRq3eJvXVdA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BDlKlhWEMI7JrKVX2pBamKwIKRZzhaSZ8J4Z7tjyPyM=; b=PannYXlF43aZ3hik3Zw65LOtvQb/Nxqwq+iDZ/CubecvwAumNM3BPEnn72uChG0sfTV2f7Bh3q3DYUR3FLep+T14zS5H1Oz/p/utJ2AYuHp6VSfC92PTl9qQ0pdgDjH35ml7XrIfHNmEwj2eeD02pam5MJc1J4yVenbtde7jrvgKSeaMe0SSOrJtf/KOWJ79JfCluhHU8VjYJQQZLTl6lZ8lyXSvdbK4m7s5KCxYMzR6BEGSZ65znHy/1aP99/zjRDd/0VQzDFAYLlZB4s8rk9AYlgp9gU7Y79BRi4FXGWagYErGMZYmzTxFeXAXJ8Mn/Z3mLT/o3eORcZNQN5DTjg== Received: from SJ0PR03CA0098.namprd03.prod.outlook.com (2603:10b6:a03:333::13) by BY5PR12MB4257.namprd12.prod.outlook.com (2603:10b6:a03:20f::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Mon, 13 Jul 2026 15:39:15 +0000 Received: from MWH0EPF000C6194.namprd02.prod.outlook.com (2603:10b6:a03:333:cafe::5f) by SJ0PR03CA0098.outlook.office365.com (2603:10b6:a03:333::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 15:39:15 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MWH0EPF000C6194.mail.protection.outlook.com (10.167.249.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 15:39:15 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:47 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Mon, 13 Jul 2026 08:38:46 -0700 Received: from [10.135.59.1] (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Mon, 13 Jul 2026 08:38:42 -0700 From: Edward Srouji Date: Mon, 13 Jul 2026 18:38:07 +0300 Subject: [PATCH rdma-next v2 8/8] RDMA/core: Fix potential use after free in ib_dealloc_pd_user() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260713-restrack-uaf-fix-resub-v2-8-bbe8bb270d51@nvidia.com> References: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> In-Reply-To: <20260713-restrack-uaf-fix-resub-v2-0-bbe8bb270d51@nvidia.com> To: Jason Gunthorpe , Leon Romanovsky , "Dennis Dalessandro" , Gal Pressman , Steve Wise , Mark Bloch , Neta Ostrovsky , Mark Zhang , Mark Zhang , Majd Dibbiny , Yishai Hadas CC: , , "Edward Srouji" , Patrisious Haddad , "Michael Guralnik" X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783957085; l=2237; i=edwards@nvidia.com; s=20251029; h=from:subject:message-id; bh=DiZfUR8iWTusf5KGCmH8juNczeptl7qhlQRRXjLAHto=; b=mv6grgUZJl30X2/k+U2oEqx6ysnQaIR4dyrbBz0tdtvvXC1RN/mMD7WnEQPfqX1MqwAPGbIFG 23tEwlzcS5XAAjWRLVktpZQoZWUo2EOxCyFfLSx25g6gX9NvzD2bwGP X-Developer-Key: i=edwards@nvidia.com; a=ed25519; pk=VME+d2WbMZT5AY+AolKh2XIdrnXWUwwzz/XLQ3jXgDM= X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MWH0EPF000C6194:EE_|BY5PR12MB4257:EE_ X-MS-Office365-Filtering-Correlation-Id: d66435ad-5619-4ad1-ba6a-08dee0f4e52d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|1800799024|376014|82310400026|23010399003|22082099003|18002099003|11063799006|5023799004|56012099006|6133799003|921020; X-Microsoft-Antispam-Message-Info: uGoD/BpSTkGn9ma7j+cmEoRuOLln5IKeGy//0Ow6VTRQ5OZtXSK8vAjE9/8+nyx3ldEDUQ42q+TAVT/DZWhrGZUBrQ4cMTSvUIWiFQyUME9s8KFmDE1A+6H4kBIzTC8VpGYPUgf1GaSGfByjyTAR5Hq1i+Lm+NDObPVIoHPoHnZdTohEQkqzknbiVhzjzAbdMyu0YtOQE+TKYqOsEMWKQyprMkbZnxAwPwOQuWe0doCyuOBnN9VsZkPbEn2iVjsAz4izdCauMzGl2bmWLTheOznzzldpa4L2QDBBs1yv2lF7Ku9ayd1jlr91Eo3f4JdlImlr6OeDj6bxCJJjUvbrv2K9FoZzYI3zMXlhWw8eVQ2GnsBhHt40cspbsNJCII8myOYG9Rph1L2o62suVELuTgO+oTA2psIaXzwlySFnf85wSN2lvQD7iddwiI9M/52UjcKNv0q7FfxyUgnr4MRQsPLIOub8fSmH1kQNT2SKm1DBOd2iUPR0Wkd/g2XIw2AKguqs21pA2sADSvqeyJwi/vYwqBrgFnEn/3th16EEk1AIhshMTBwHgF3yR4sxZD65xYDF7GS7aR00ZfXUdE63r1jVQiyWMboMrZT/n6pPxPri/emDnqW/pgR10A9QNlPYbxCwap0TWfshM89JVvTdAZAo1b7VzvCccYtnMkCxiWWWGaCfjBttAR9dOCtDiZS2ZC6PLBCaBXyF0c8xMcueh+HZ/YAhZuHBERNNcpTJoFqmtU1wkYXgajH8XgBQWUoc X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(1800799024)(376014)(82310400026)(23010399003)(22082099003)(18002099003)(11063799006)(5023799004)(56012099006)(6133799003)(921020);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: kZdyPlYc6e16upxRIdbQ4DpIm0YwMqpGbQ4fSNmYvz2NU289+mOVthnvts+Ss6XsGVEOgaDvcuSd8T4PFLzNmqFIcSNern7C563+nsjDdeXdM+wTj7vUrqXz3Qi1WtfoorPiW2U13opetyWqfT+0tKAkWfQvTQezEyNjgnCv+cj1LDFqbrjUhtj4BpcLhHDDMcpPX1mW1f1zegnpfXZmhPxHDaeC/KiJ6JaZX5hHZiun7wMF+okJaDMfWFGMCOWW3GyXQjN9vCZYln56GZrk/NoVZE7atV1GjuPVMxhPt7RjGOLXoDstcaTZz78Z3jb7uGd7tQeeKg+HW/wAAmoFrEKjm3q5bnP/OXI4vBwEKGKrBBTCFfs9tP97qPLCRxvpF6W0yxp67topIU4py/LYxZsAqH/2MfPoTpj/27UIw+4Rca6qeIqlDxC5ATfdbNPM X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2026 15:39:15.3881 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d66435ad-5619-4ad1-ba6a-08dee0f4e52d X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MWH0EPF000C6194.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR12MB4257 From: Patrisious Haddad When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of ib_dealloc_pd_user(), which is too late, since by that point vendor-specific resources associated with the PD might already be freed. This can leave a short window where the PD remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_begin_del() call to the start of ib_dealloc_pd_user(), ensuring that the PD is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a PD that is in the process of destruction. In addition, this change preserves the intended inverted order between create and destroy routines: resources are added to restrack at the end of successful creation, and hence shall be removed from the restrack first thing during the destruction flow, which keeps the lifecycle management consistent and predictable. Fixes: 91a7c58fce06 ("RDMA: Restore ability to fail on PD deallocate") Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji --- drivers/infiniband/core/verbs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verb= s.c index bfbc25dee95d031f91ffef5389e81faa08170719..f86e6f30b1df08396c151000fa7= 184574a034e0f 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -392,6 +392,7 @@ int ib_dealloc_pd_user(struct ib_pd *pd, struct ib_udat= a *udata) { int ret; =20 + rdma_restrack_begin_del(&pd->res); if (pd->__internal_mr) { ret =3D pd->device->ops.dereg_mr(pd->__internal_mr, NULL); WARN_ON(ret); @@ -399,10 +400,12 @@ int ib_dealloc_pd_user(struct ib_pd *pd, struct ib_ud= ata *udata) } =20 ret =3D pd->device->ops.dealloc_pd(pd, udata); - if (ret) + if (ret) { + rdma_restrack_abort_del(&pd->res); return ret; + } =20 - rdma_restrack_del(&pd->res); + rdma_restrack_commit_del(&pd->res); kfree(pd); return ret; } --=20 2.49.0