rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
mapping and registration can fail. On failure, __rds_rdma_map() unpins
the pages and frees the scatterlist, but rds_ib_free_frmr() can still
return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local
privilege escalation. KASAN detects the resulting use-after-free when the
MR is later torn down:

BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
Read of size 8

Call Trace:
 __rds_ib_teardown_mr
 rds_ib_unreg_frmr
 rds_ib_flush_mr_pool
 rds_ib_flush_mrs
 rds_free_mr
 rds_setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
mapping fails, return directly while the MR fields remain clear; the caller
keeps ownership of the scatterlist and its pinned pages. If a later
registration step fails, unmap the scatterlist and clear the MR fields
before returning.

Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
Cc: stable@vger.kernel.org
Signed-off-by: Dongliang Qin <cccccccccccc777777@gmail.com>
---
Changes in v2:
- Store the scatterlist in the MR only after DMA mapping succeeds.
- Return directly if DMA mapping fails, leaving the MR fields clear.
- Link to v1: https://lore.kernel.org/netdev/20260920063449.1594203-1-cccccccccccc777777@gmail.com/

net/rds/ib_frmr.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
index bd8611911..8397aa4a1 100644
--- a/net/rds/ib_frmr.c
+++ b/net/rds/ib_frmr.c
@@ -204,19 +204,16 @@ static int rds_ib_map_frmr(struct rds_ib_device *rds_ibdev,
 	 */
 	rds_ib_teardown_mr(ibmr);
 
-	ibmr->sg = sg;
-	ibmr->sg_len = sg_len;
-	ibmr->sg_dma_len = 0;
 	frmr->sg_byte_len = 0;
-	WARN_ON(ibmr->sg_dma_len);
-	ibmr->sg_dma_len = ib_dma_map_sg(dev, ibmr->sg, ibmr->sg_len,
+	ibmr->sg_dma_len = ib_dma_map_sg(dev, sg, sg_len,
 					 DMA_BIDIRECTIONAL);
 	if (unlikely(!ibmr->sg_dma_len)) {
 		pr_warn("RDS/IB: %s failed!\n", __func__);
 		return -EBUSY;
 	}
 
-	frmr->sg_byte_len = 0;
+	ibmr->sg = sg;
+	ibmr->sg_len = sg_len;
 	frmr->dma_npages = 0;
 	len = 0;
 
@@ -264,6 +261,8 @@ static int rds_ib_map_frmr(struct rds_ib_device *rds_ibdev,
 	ib_dma_unmap_sg(rds_ibdev->dev, ibmr->sg, ibmr->sg_len,
 			DMA_BIDIRECTIONAL);
 	ibmr->sg_dma_len = 0;
+	ibmr->sg = NULL;
+	ibmr->sg_len = 0;
 	return ret;
 }
 
-- 
2.43.0

On Tue, 2026-09-22 at 11:15 +0800, Dongliang Qin wrote:
> rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
> mapping and registration can fail. On failure, __rds_rdma_map() unpins
> the pages and frees the scatterlist, but rds_ib_free_frmr() can still
> return the MR to the pool with the stale pointer set.
> 
> This leaves the pool with a dangling scatterlist and can lead to local
> privilege escalation. KASAN detects the resulting use-after-free when the
> MR is later torn down:
> 
> BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
> Read of size 8
> 
> Call Trace:
>  __rds_ib_teardown_mr
>  rds_ib_unreg_frmr
>  rds_ib_flush_mr_pool
>  rds_ib_flush_mrs
>  rds_free_mr
>  rds_setsockopt
> 
> Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
> mapping fails, return directly while the MR fields remain clear; the caller
> keeps ownership of the scatterlist and its pinned pages. If a later
> registration step fails, unmap the scatterlist and clear the MR fields
> before returning.
> 
> Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dongliang Qin <cccccccccccc777777@gmail.com>

New v2 looks good to me.  Thanks!

Reviewed-by: Allison Henderson <achender@kernel.org>
Allison

> ---
> Changes in v2:
> - Store the scatterlist in the MR only after DMA mapping succeeds.
> - Return directly if DMA mapping fails, leaving the MR fields clear.
> - Link to v1: https://lore.kernel.org/netdev/20260920063449.1594203-1-cccccccccccc777777@gmail.com/
> 
> net/rds/ib_frmr.c | 11 +++++------
> 1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
> index bd8611911..8397aa4a1 100644
> --- a/net/rds/ib_frmr.c
> +++ b/net/rds/ib_frmr.c
> @@ -204,19 +204,16 @@ static int rds_ib_map_frmr(struct rds_ib_device *rds_ibdev,
>  	 */
>  	rds_ib_teardown_mr(ibmr);
>  
> -	ibmr->sg = sg;
> -	ibmr->sg_len = sg_len;
> -	ibmr->sg_dma_len = 0;
>  	frmr->sg_byte_len = 0;
> -	WARN_ON(ibmr->sg_dma_len);
> -	ibmr->sg_dma_len = ib_dma_map_sg(dev, ibmr->sg, ibmr->sg_len,
> +	ibmr->sg_dma_len = ib_dma_map_sg(dev, sg, sg_len,
>  					 DMA_BIDIRECTIONAL);
>  	if (unlikely(!ibmr->sg_dma_len)) {
>  		pr_warn("RDS/IB: %s failed!\n", __func__);
>  		return -EBUSY;
>  	}
>  
> -	frmr->sg_byte_len = 0;
> +	ibmr->sg = sg;
> +	ibmr->sg_len = sg_len;
>  	frmr->dma_npages = 0;
>  	len = 0;
>  
> @@ -264,6 +261,8 @@ static int rds_ib_map_frmr(struct rds_ib_device *rds_ibdev,
>  	ib_dma_unmap_sg(rds_ibdev->dev, ibmr->sg, ibmr->sg_len,
>  			DMA_BIDIRECTIONAL);
>  	ibmr->sg_dma_len = 0;
> +	ibmr->sg = NULL;
> +	ibmr->sg_len = 0;
>  	return ret;
>  }
>