register_pkey_tree() ignores errors from register_one_pkey_tree() and
continues registering the remaining slaves. The per-slave error path has
already released the pkey parent kobjects, but their pointers remain
stored in the device. A later device cleanup therefore passes the stale
pointers to kobject_put(), causing a use-after-free.

Clear the parent pointers after releasing a failed slave tree and skip
unregistered trees during device cleanup. This preserves the existing
best-effort registration behavior while preventing a second cleanup of
the failed tree.

Fixes: c1e7e466120b ("IB/mlx4: Add iov directory in sysfs under the ib device")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/infiniband/hw/mlx4/sysfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
index e688ad66a895..5438224bf325 100644
--- a/drivers/infiniband/hw/mlx4/sysfs.c
+++ b/drivers/infiniband/hw/mlx4/sysfs.c
@@ -751,11 +751,13 @@ static int register_one_pkey_tree(struct mlx4_ib_dev *dev, int slave)
 		kobject_put(p);
 	}
 	kobject_put(dev->dev_ports_parent[slave]);
+	dev->dev_ports_parent[slave] = NULL;
 
 err_ports:
 	kobject_put(dev->pkeys.device_parent[slave]);
 	/* extra put for the device_parent create_and_add */
 	kobject_put(dev->pkeys.device_parent[slave]);
+	dev->pkeys.device_parent[slave] = NULL;
 
 fail_dev:
 	kobject_put(dev->iov_parent);
@@ -785,6 +787,8 @@ static void unregister_pkey_tree(struct mlx4_ib_dev *device)
 		return;
 
 	for (slave = device->dev->persist->num_vfs; slave >= 0; --slave) {
+		if (!device->pkeys.device_parent[slave])
+			continue;
 		list_for_each_entry_safe(p, t,
 					 &device->pkeys.pkey_port_list[slave],
 					 entry) {
-- 
2.43.0

On Sun, 16 Aug 2026 00:45:10 -0400, Shuangpeng Bai wrote:
> register_pkey_tree() ignores errors from register_one_pkey_tree() and
> continues registering the remaining slaves. The per-slave error path has
> already released the pkey parent kobjects, but their pointers remain
> stored in the device. A later device cleanup therefore passes the stale
> pointers to kobject_put(), causing a use-after-free.
> 
> Clear the parent pointers after releasing a failed slave tree and skip
> unregistered trees during device cleanup. This preserves the existing
> best-effort registration behavior while preventing a second cleanup of
> the failed tree.
> 
> [...]

Applied, thanks!

[1/1] IB/mlx4: Fix use-after-free on pkey sysfs registration failure
      https://git.kernel.org/rdma/rdma/c/1af874e9f4ce22

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>