RDMA/uverbs: Make CQ handle mandatory for WQ creation

[PATCH v2] RDMA/uverbs: Make CQ handle mandatory for WQ creation

Posted by lirongqing 2 weeks ago

From: Li RongQing <lirongqing@baidu.com>

UVERBS_ATTR_CREATE_WQ_CQ_HANDLE is declared UA_OPTIONAL in the ioctl
method definition, so the mandatory attribute bitmap does not enforce
its presence.  When userspace omits it, uverbs_attr_get_obj() returns
ERR_PTR(-ENOENT) and the handler stores that error pointer into
wq_init_attr.cq without validation.

The bogus cq pointer is then passed to the driver's create_wq callback.
In the mlx5 case, create_rq() calls to_mcq(init_attr->cq) which applies
container_of to the ERR_PTR value, producing a near-NULL pointer.  The
subsequent access in get_rq_ts_format() triggers a kernel NULL pointer
dereference:

  BUG: kernel NULL pointer dereference, address: 0000000000000296
  RIP: 0010:create_rq+0x32/0x550 [mlx5_ib]
  Call Trace:
   mlx5_ib_create_wq+0x14a/0x210 [mlx5_ib]
   ib_uverbs_handler_UVERBS_METHOD_WQ_CREATE+0x1f0/0x320 [ib_uverbs]
   ib_uverbs_run_method+0x296/0x320 [ib_uverbs]
   ib_uverbs_cmd_verbs+0x1a0/0x260 [ib_uverbs]
   ib_uverbs_ioctl+0xa8/0x120 [ib_uverbs]

A WQ without a CQ was never valid; the legacy write path always required
one via uobj_get_obj_read() in ib_uverbs_ex_create_wq().  Declare the
attribute UA_MANDATORY so the uverbs framework rejects the ioctl early
when the CQ handle is missing, before the handler ever runs.

Fixes: ef3bc084a8ed ("IB/uverbs: Introduce create/destroy WQ commands over ioctl")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
Diff with v1: declare it as UA_MANDATORY, rather than
adding a manual IS_ERR check in the handler.

 drivers/infiniband/core/uverbs_std_types_wq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/uverbs_std_types_wq.c b/drivers/infiniband/core/uverbs_std_types_wq.c
index 7ded833..c23f455 100644
--- a/drivers/infiniband/core/uverbs_std_types_wq.c
+++ b/drivers/infiniband/core/uverbs_std_types_wq.c
@@ -140,7 +140,7 @@ DECLARE_UVERBS_NAMED_METHOD(
 	UVERBS_ATTR_IDR(UVERBS_ATTR_CREATE_WQ_CQ_HANDLE,
 			UVERBS_OBJECT_CQ,
 			UVERBS_ACCESS_READ,
-			UA_OPTIONAL),
+			UA_MANDATORY),
 	UVERBS_ATTR_FD(UVERBS_ATTR_CREATE_WQ_EVENT_FD,
 		       UVERBS_OBJECT_ASYNC_EVENT,
 		       UVERBS_ACCESS_READ,
-- 
2.9.4

Re: [PATCH v2] RDMA/uverbs: Make CQ handle mandatory for WQ creation

Posted by Leon Romanovsky 1 week, 3 days ago

On Fri, 11 Sep 2026 10:15:57 +0800, lirongqing wrote:
> UVERBS_ATTR_CREATE_WQ_CQ_HANDLE is declared UA_OPTIONAL in the ioctl
> method definition, so the mandatory attribute bitmap does not enforce
> its presence.  When userspace omits it, uverbs_attr_get_obj() returns
> ERR_PTR(-ENOENT) and the handler stores that error pointer into
> wq_init_attr.cq without validation.
> 
> The bogus cq pointer is then passed to the driver's create_wq callback.
> In the mlx5 case, create_rq() calls to_mcq(init_attr->cq) which applies
> container_of to the ERR_PTR value, producing a near-NULL pointer.  The
> subsequent access in get_rq_ts_format() triggers a kernel NULL pointer
> dereference:
> 
> [...]

Applied, thanks!

[1/1] RDMA/uverbs: Make CQ handle mandatory for WQ creation
      https://git.kernel.org/rdma/rdma/c/f7d28791433d37

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>

Re: [PATCH v2] RDMA/uverbs: Make CQ handle mandatory for WQ creation

Posted by Kalesh Anakkur Purayil 2 weeks ago

On Fri, Sep 11, 2026 at 7:46 AM lirongqing <lirongqing@baidu.com> wrote:

> From: Li RongQing <lirongqing@baidu.com>
>
> UVERBS_ATTR_CREATE_WQ_CQ_HANDLE is declared UA_OPTIONAL in the ioctl
> method definition, so the mandatory attribute bitmap does not enforce
> its presence.  When userspace omits it, uverbs_attr_get_obj() returns
> ERR_PTR(-ENOENT) and the handler stores that error pointer into
> wq_init_attr.cq without validation.
>
> The bogus cq pointer is then passed to the driver's create_wq callback.
> In the mlx5 case, create_rq() calls to_mcq(init_attr->cq) which applies
> container_of to the ERR_PTR value, producing a near-NULL pointer.  The
> subsequent access in get_rq_ts_format() triggers a kernel NULL pointer
> dereference:
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000296
>   RIP: 0010:create_rq+0x32/0x550 [mlx5_ib]
>   Call Trace:
>    mlx5_ib_create_wq+0x14a/0x210 [mlx5_ib]
>    ib_uverbs_handler_UVERBS_METHOD_WQ_CREATE+0x1f0/0x320 [ib_uverbs]
>    ib_uverbs_run_method+0x296/0x320 [ib_uverbs]
>    ib_uverbs_cmd_verbs+0x1a0/0x260 [ib_uverbs]
>    ib_uverbs_ioctl+0xa8/0x120 [ib_uverbs]
>
> A WQ without a CQ was never valid; the legacy write path always required
> one via uobj_get_obj_read() in ib_uverbs_ex_create_wq().  Declare the
> attribute UA_MANDATORY so the uverbs framework rejects the ioctl early
> when the CQ handle is missing, before the handler ever runs.
>
> Fixes: ef3bc084a8ed ("IB/uverbs: Introduce create/destroy WQ commands over
> ioctl")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>


LGTM,
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>


-- 
Regards,
Kalesh AP