summaryrefslogtreecommitdiff
path: root/drivers/infiniband/sw
AgeCommit message (Collapse)Author
2026-10-18RDMA/rxe: Clear pkt->qp before the early drop exits in rxe_rcv()Zhiwei Zhang
rxe_rcv() puts pkt->qp at its drop label, but leaves pkt->qp uninitialized on the two paths that take an early goto: if (unlikely(skb->len < RXE_BTH_BYTES)) goto drop; if (rxe_chk_dgid(rxe, skb) < 0) goto drop; pkt->opcode = bth_opcode(pkt); pkt->psn = bth_psn(pkt); pkt->qp = NULL; <- too late for the gotos above ... drop: if (pkt->qp) rxe_put(pkt->qp); pkt points into skb->cb, which rxe does not own at this point: the network stack has used that space for its own state. For IPv6, ip6_rcv_core() memsets inet6_skb_parm and then writes IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); at offset 14, so the qword at cb + 8, which is where pkt->qp lives, reads back as 0x0006000000000000 for every IPv6 packet. Any IPv6 datagram to port 4791 whose payload is shorter than the BTH takes the first goto and reaches the drop label with that value, so rxe_put() runs refcount_dec_and_test() on 0x0006000000000150 and the kernel faults, in softirq, on a non-canonical address: general protection fault, probably for non-canonical address 0x0006000000000150: 0000 [#1] PREEMPT SMP RIP: 0010:__rxe_put+0x.../... Call Trace: <IRQ> rxe_rcv+0x.../... [rdma_rxe] rxe_udp_encap_recv+0x.../... [rdma_rxe] udp_queue_rcv_one_skb ... Kernel panic - not syncing: Fatal exception in interrupt The fault happens in softirq, so it panics even with panic_on_oops=0, and with panic=0 the machine hangs until it is power cycled. A remote sender only needs to send an empty UDP datagram to port 4791; no RDMA connection, GID or other state is involved and the rxe socket is bound in init_net. IPv4 is not affected: ip_rcv_core() memsets the whole inet_skb_parm, so the pkt->qp slot is zero there. Fix by clearing pkt->qp before the first early exit. pkt->qp is only ever assigned a reference-owning value by hdr_check() and rxe_rcv_mcast_pkt(), both of which run after this point, so the put at the drop label stays balanced. The ordering has been unsafe since the driver was merged: the two early gotos have preceded pkt->qp = NULL in every version since 8700e3e7c485. Testing done: the driver was built and run on a 6.2 vendor tree that carries this code, where a single 0-byte IPv6 datagram to port 4791 reproduced the panic above (that tree does not pull the UDP header in rxe_udp_encap_recv(), so payloads of 0..3 bytes reach the first goto there, versus 0..11 on mainline). With this change, the same packets are dropped as intended and tracing the drop label shows pkt->qp is 0 on every path that reaches it. Not done: the mainline tree was not built in the environment used to prepare this, and the reproducer is left out of this message on purpose - both are available on request. Fixes: 8700e3e7c485 ("Soft RoCE driver") Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Zhiwei Zhang <202275009@qq.com> Link: https://patch.msgid.link/tencent_FBB0EE9F592FD21FD4B0F3BFAD3336765209@qq.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-15IB/rdmavt: Fix error unwind path for qp_priv_init() in rvt_create_qp()Serhat Kumral
If driver_f.qp_priv_init() fails, execution jumps to bail_rq_wq, which bypasses bail_qpn. Because alloc_qpn() has already succeeded at this point, the allocated QP number is left unreleased. Jump to bail_qpn instead to ensure the QPN is properly freed via rvt_free_qpn(). Fixes: 5190f052a3654 ("IB/hfi1: Allow the driver to initialize QP priv struct") Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com> Link: https://patch.msgid.link/20261015102518.15780-1-serhatkumral1@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-15RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]Youngsung Ahn
wr_opcode_mask() indexes the global rxe_wr_opcode_info[] array with a caller-supplied opcode and no bounds check. For a user QP the WQE comes from an mmap'd SQ ring, so wqe->wr.opcode is an attacker-controlled __u32 read back by the requester (req_next_wqe() -> rxe_requester()); rxe_post_send() takes the qp->is_user branch and never runs validate_send_wr(), whose only opcode check is itself !wr_opcode_mask() (it indexes before it checks). rxe_wr_opcode_info[] has entries only up to IB_WR_REG_MR, so an out-of-range opcode reads out of bounds and the result is used as a mask and dereferenced; observed as a KASAN global-out-of-bounds "Read of size 4" and a wild-pointer oops. Return a zero mask for an out-of-range opcode, matching how validate_send_wr() already treats a zero mask (an invalid WR), so no path indexes the array out of bounds. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com> Link: https://patch.msgid.link/20261002164552.294749-1-ays511.kr@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-15RDMA/rxe: Fix out-of-range unsigned-to-signed conversion for RDMA message in ↵Honggang LI
2GiB size When RDMA READ request for 2GiB in single WR, res->read.resid is u32 0x80000000, which is INT_MIN (-2147483648). payload = min_t(int, res->read.resid, mtu); The `min_t` function will return -2147483648 for payload. The wrong size is propagated through call chain, `read_reply` -> `prepare_ack_packet` -> `rxe_init_packet` -> `alloc_skb` . `alloc_skb` failed because of invalid size. The passive side failed to emit response packet for RDMA READ request. After fixed it, the active side of RDMA READ failed with error code "IB_WC_LOC_PROT_ERR". When RDMA_READ_RESPONSE_FIRST packet recived by the active side, `do_read` call `copy_data`. dma->resid is u32 0x80000000. int resid = dma->resid; This conversion set resid to -2147483648. `copy_data` abort as length greater than resid. RDMA SEND and WRITE 2GiB message works too, after fixed these two bugs. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Honggang LI <honggangli@163.com> Link: https://patch.msgid.link/20261002142250.657151-1-honggangli@163.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-15RDMA/rxe: validate inline sge_offset in finish_packet() before indexing ↵Youngsung Ahn
inline_data[] For a user QP, rxe_post_send() takes the qp->is_user branch and never runs init_send_wqe(), so dma.length/resid/num_sge/cur_sge/sge_offset all come straight from the mmap'd SQ ring. In the inline send path finish_packet() uses sge_offset directly as an index: u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset]; memcpy(payload_addr(pkt), tmp, payload); inline_data is a flex array whose capacity is qp->sq.max_inline, but sge_offset is a u32 from user space, so the source pointer is displaced arbitrarily past the WQE and the memcpy reads out of bounds. commit 126c757e4cd4 ("RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]") added num_sge/cur_sge checks on the send path but not sge_offset, the third attacker-controlled index in the same struct. Read sge_offset once with READ_ONCE() and bound it (and the payload that follows it) by qp->sq.max_inline before indexing, so the value that is validated is the value that is used. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com> Link: https://patch.msgid.link/20261001152433.3259573-1-ays511.kr@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-15RDMA/rxe: bound the ODP page index against the umem in rxe_check_pagefault()Youngsung Ahn
An ODP MR has a page array, map.pfn_list[]. Its size is computed from the umem start address. But rxe_check_pagefault() builds the index into that array from an iova that is relative to the same start, while the access itself was range-checked against the MR's iova (ibmr.iova). Those two bases do not have to match. reg_mr only requires that start and hca_va have the same page offset, so a user can register an MR with hca_va = start + N*PAGE. The difference then becomes an index skew of (hca_va - start) >> PAGE_SHIFT. Nothing compares the result with the size of pfn_list[], so the read goes past the end of the array. An unprivileged local user can reach this with a single RDMA operation on a self-connected rxe QP. KASAN reports a slab-out-of-bounds read. If the out-of-bounds qword happens to look like a writable HMM pfn, rxe then copies the payload into a page the user never registered. Reject an index that falls outside the umem and take the fault path instead. That path rejects the out-of-range access in ib_umem_odp_map_dma_and_lock(), which does check the umem range. The other users of pfn_list[], __rxe_odp_mr_copy() and the atomic helpers, run only after a successful map, so this single check covers them too. Fixes: 2fae67ab63db ("RDMA/rxe: Add support for Send/Recv/Write/Read with ODP") Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com> Link: https://patch.msgid.link/20261004153246.2951263-1-ays511.kr@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-15RDMA/rxe: reject IB_WR_REG_MR from user QPs in rxe_reg_fast_mr()Youngsung Ahn
IB_WR_REG_MR is documented as kernel-only ("can not be issued by userspace"), but nothing enforces it. rxe_wr_opcode_info[IB_WR_REG_MR] sets WR_LOCAL_OP_MASK for IB_QPT_RC, a QP type userspace can create, so a user QP that writes opcode = IB_WR_REG_MR into its mmap'd SQ ring reaches rxe_do_local_ops() -> rxe_reg_fast_mr(). That function then trusts the ring-supplied fields: struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr); ... if (unlikely(mr->state != RXE_MR_STATE_FREE)) /* deref */ ... mr->access = access; /* write */ For a user QP wqe->wr.wr.reg.mr is a fully attacker-chosen pointer, so this is an arbitrary-kernel-address dereference (arbitrary read confirmed, oops). No existing check distinguishes a user QP on this path. Reject IB_WR_REG_MR for user QPs before dereferencing the supplied pointer. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com> Link: https://patch.msgid.link/20261001152426.3259522-1-ays511.kr@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-15RDMA/rxe: refuse to destroy a QP with type 2 MWs still boundYoungsung Ahn
Binding a type 2 memory window takes a reference on the QP: rxe_do_bind_mw() does rxe_get(qp) and stores it in mw->qp. That reference is released only when the window is invalidated (rxe_do_invalidate_mw() on IB_WR_LOCAL_INV) or the window itself is destroyed (rxe_mw_cleanup()). rxe_qp_chk_destroy() does not account for those references -- it only refuses when qp->mcg_num is non-zero. So an unprivileged user can bind a type 2 MW to a QP and then destroy the QP while the binding is still live. __rxe_cleanup() cannot drop the QP refcount to zero (the MW still holds a reference), hits its -ETIMEDOUT path, and frees the QP anyway; mw->qp is left dangling. When the MW is later invalidated or deallocated, rxe_mw_cleanup()/rxe_do_invalidate_mw() do rxe_put(mw->qp) on the freed struct rxe_qp -- a use-after-free write (refcount_dec, and complete()/list work if it reaches zero) reachable from userspace. IB_WR_BIND_MW is a local operation, so no peer is required. Track the number of type 2 MWs bound to a QP and refuse to destroy the QP while that count is non-zero, returning -EBUSY exactly as the existing multicast-attachment check does. The window must be invalidated or deallocated, which drops the reference and the count, before the QP can be destroyed. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com> Link: https://patch.msgid.link/20260930182223.2511145-1-ays511.kr@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-13RDMA/siw: Enforce IB_ACCESS_REMOTE_READ for read responsesHaitam Lazaar
When generating an RDMA READ response (SIW_OP_READ_RESPONSE), siw_check_sgl_tx() unconditionally passes 0 as the required permission mask: /* Reference memory to be tx'd w/o checking access for LOCAL_READ */ rv = siw_check_sgl_tx(qp->pd, wqe, 0); Because perms is 0, siw_check_mem()'s authorization test: if ((mem->perms & perms) < perms) evaluates to (mem->perms & 0) < 0, which is always false. Consequently, an untrusted remote peer can issue an RDMA Read targeting any valid STag in the Protection Domain, even if the memory was registered strictly as write-only (IB_ACCESS_REMOTE_WRITE) without IB_ACCESS_REMOTE_READ. Enforce that the target memory region was granted IB_ACCESS_REMOTE_READ when answering SIW_OP_READ_RESPONSE work queue entries, while preserving perms = 0 for standard local sends. Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Signed-off-by: Haitam Lazaar <haitam@lazaarsec.com> Link: https://patch.msgid.link/1a12ad1d83f.19cd98924357428.7073029566232810804@lazaarsec.com Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-30Merge remote-tracking branch 'ionic/ionic-shared' into wip/leon-for-nextLeon Romanovsky
Preparatory patch to support SRQ in RDMA ionic driver. Signed-off-by: Leon Romanovsky <leon@kernel.org> * ionic/ionic-shared: (1790 commits) net: ionic: Fetch qid allocation and SRQ capability from firmware Linux 7.3-rc4 ...
2026-09-29RDMA/siw: Fix length of first chunk in siw_try_1seg()Serhat Kumral
When a short-single SGE payload crosses a page boundary, siw_try_1seg() computes the length of the first chunk as the amount that spills into the second page instead of the amount left in the first page part = bytes - (PAGE_SIZE - off); Use the remaining length of the first page as the first chunk. Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Link: https://patch.msgid.link/r/20260927115351.12245-1-serhatkumral1@gmail.com Assisted-by: LLM Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com> Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-09-29RDMA/siw: drop duplicate check_app_limited in siw_tcp_sendpagesGeliang Tang
After do_tcp_sendpages() was converted to use MSG_SPLICE_PAGES and later inlined as direct tcp_sendmsg_locked() calls, callers that previously needed an explicit tcp_rate_check_app_limited(sk) to cover do_tcp_sendpages() no longer need it. tcp_sendmsg_locked() performs the check on every path that queues data, making the outer call redundant. The site changed here, siw_tcp_sendpages() in siw_qp_tx.c, holds the socket lock and invokes tcp_sendmsg_locked() on every iteration. The early-return paths in tcp_sendmsg_locked() that skip tcp_rate_check_app_limited() - the MSG_ZEROCOPY allocation failure and MSG_FASTOPEN branches - return without queueing any MSG_SPLICE_PAGES data, so there is no functional consequence from omitting the outer check. Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn> Link: https://patch.msgid.link/32ef40cc81486adb8f2d43585224ab44d7e77f73.1790234916.git.tanggeliang@kylinos.cn Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-29RDMA/rxe: Reject prefetch of a non-ODP MRNorbert Szetei
rxe_ib_advise_mr_prefetch() and rxe_ib_prefetch_sg_list() look up the MR by lkey and hand it to rxe_odp_do_pagefault_and_lock() without checking that it is an ODP MR. That path runs to_ib_umem_odp() on mr->umem, and for a non-ODP MR mr->umem is a plain struct ib_umem from ib_umem_get(), so the container_of() in to_ib_umem_odp() lands past the end of the object and ib_umem_odp_map_dma_and_lock() reads its ib_umem_odp fields out of bounds. lookup_mr() validates the lkey, PD, access and state but not the MR type, and IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH is accepted for any MR. BUG: KASAN: slab-out-of-bounds in ib_umem_odp_map_dma_and_lock+0x884/0x8a0 Read of size 8 at addr ffff88810a3ebcf0 by task advi/921 ib_umem_odp_map_dma_and_lock+0x884/0x8a0 rxe_ib_advise_mr+0x543/0xad0 ib_uverbs_handler_UVERBS_METHOD_ADVISE_MR+0x446/0x530 ib_uverbs_cmd_verbs+0x2b3c/0x3b20 ib_uverbs_ioctl+0x1e3/0x310 Allocated by task 921: __ib_umem_get_va+0x13e/0xae0 rxe_mr_init_user+0x2ae/0xb00 rxe_reg_user_mr+0x337/0x510 The buggy address belongs to the object at ffff88810a3ebc80 which belongs to the cache kmalloc-96 of size 96 Ask lookup_mr() for IB_ACCESS_ON_DEMAND in both the synchronous and the asynchronous prefetch arm. mr->access carries that flag only for an MR registered as ODP, so the existing (access & mr->access) != access test rejects a plain MR and the prefetch fails with -EINVAL. Fixes: 3576b0df1588 ("RDMA/rxe: Implement synchronous prefetch for ODP MRs") Signed-off-by: Norbert Szetei <norbert@doyensec.com> Link: https://patch.msgid.link/20260923-rxe-advise-mr-v3-v3-2-95e1a4077e4d@doyensec.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-29RDMA/rxe: Reject IB_ACCESS_ON_DEMAND changes after MR creationNorbert Szetei
Whether an MR is an ODP MR is decided once, at registration time: rxe_reg_user_mr() picks rxe_odp_mr_init_user() over rxe_mr_init_user() based on IB_ACCESS_ON_DEMAND, and only the former builds an ib_umem_odp via ib_umem_odp_get(). The umem cannot change type afterwards, and is_odp_mr() reads mr->umem->is_odp. Two paths assign mr->access after that point and can leave it describing an MR type the umem does not have: rxe_rereg_user_mr() with IB_MR_REREG_ACCESS overwrites mr->access with the caller's value, and IB_ACCESS_ON_DEMAND is part of RXE_ACCESS_SUPPORTED_MR, so userspace can set the flag on a plain MR or clear it on an ODP MR while the umem stays what it was. rxe_reg_fast_mr() takes mr->access from the REG_MR work request unmasked and moves the MR to RXE_MR_STATE_VALID, on an MR that rxe_mr_init_fast() left with a NULL umem. Reject IB_ACCESS_ON_DEMAND in both, so mr->access carries the flag only for an MR that has an ODP umem and the flag can be used to identify one. Fixes: 544c7f62cf32 ("RDMA/rxe: Implement rereg_user_mr") Signed-off-by: Norbert Szetei <norbert@doyensec.com> Link: https://patch.msgid.link/20260923-rxe-advise-mr-v3-v3-1-95e1a4077e4d@doyensec.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-29RDMA/rxe: unpublish the per-net tunnel socket beforeBinbin Deng
KASAN reports a slab-use-after-free in ip6_route_output_flags() reached from rxe_find_route(), with the free in __sk_destruct() after rxe_sock_put(), and a user with CAP_NET_ADMIN can remove the device with "rdma link del rxe0" while RoCE v2 over IPv6 traffic keeps looking the socket up. BUG: KASAN: slab-use-after-free in ip6_route_output_flags+0x300/0x360 Read of size 4 at addr ffff888115ddd794 by task kworker/u32:6/309 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? ip6_route_output_flags+0x300/0x360 kasan_report+0xce/0x100 ? ip6_route_output_flags+0x300/0x360 ip6_route_output_flags+0x300/0x360 ip6_dst_lookup_tail.constprop.0+0x76c/0xcc0 ? ct_nmi_exit+0xc3/0xf0 ip6_dst_lookup_flow+0xf5/0x1e0 ? __pfx_ip6_dst_lookup_flow+0x10/0x10 rxe_find_route+0x426/0xa30 ? __kasan_slab_alloc+0x6e/0x70 ? __pfx_rxe_find_route+0x10/0x10 ? kmem_cache_alloc_node_noprof+0x141/0x370 ? kmalloc_reserve+0x103/0x2b0 ? rxe_icrc_generate+0x229/0x330 ? __pfx___alloc_skb+0x10/0x10 rxe_prepare+0x9e8/0x18b0 ? rxe_init_packet+0x3c7/0x4f0 rxe_requester+0x1a0f/0x51f0 ? rxe_completer+0x1de9/0x38c0 ? __pfx_rxe_completer+0x10/0x10 ? __queue_work+0x43e/0x11f0 ? __pfx_rxe_requester+0x10/0x10 ? irqentry_exit+0xd2/0x640 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_rxe_sender+0x10/0x10 rxe_sender+0xe/0x30 do_work+0x144/0x470 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 146020: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_noprof+0x130/0x360 sk_prot_alloc+0x56/0x210 Fix by clearing the per-net pointer before the last reference is dropped. Fixes: f1327abd6abed ("RDMA/rxe: Support RDMA link creation and destruction per net namespace") Signed-off-by: Binbin Deng <18983559317@163.com> Link: https://patch.msgid.link/20260923051800.244740-1-18983559317@163.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-23RDMA/siw: Fix qp use-after-free in siw_get_base_qp()Wentao Liang
The reference taken by siw_qp_id2obj() is dropped before the address of the embedded ib_qp is taken from the QP. If that reference was the last one the QP is freed and the pointer returned to the iwarp core is dangling; the core only pins the QP with iw_add_ref() after the call has returned. Copy the pointer while the reference is still held. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260916184400.2093106-1-vulab@iscas.ac.cn Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-15RDMA/rxe: Use validated num_sge in local bufferNicolas Morey
For both SRQ and non-SRQ receive paths, the WQE is copied into a local buffer to provide a kernel-owned, validated copy. While calculating the memcpy size from the validated num_sge prevents overflow during the copy, memcpy() itself still copies num_sge from shared memory. A concurrent userspace modification before or during memcpy() leaves an unvalidated num_sge in the local buffer, leading to potential out-of-bounds reads in rxe_resp_check_length() and copy_data() causing: BUG: KASAN: slab-out-of-bounds in rxe_receiver+0x8109/0x9ec0 [rdma_rxe] Read of size 4 at addr ffff88812c4867f8 by task kworker/u9:6/361 Workqueue: rxe_wq do_work [rdma_rxe] Call Trace: rxe_receiver+0x8109/0x9ec0 [rdma_rxe] do_work+0x149/0x610 [rdma_rxe] process_one_work+0x726/0x10a0 The buggy address belongs to the object at ffff88812c486000 which belongs to the cache kmalloc-part-13-2k of size 2048 The buggy address is located 0 bytes to the right of allocated 2040-byte region [ffff88812c486000, ffff88812c4867f8) Explicitly assign the validated num_sge to the local buffer after the copy to prevent this race. Fixes: 22b8fbded65b ("RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe") Fixes: d6ab440240a0 ("RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path") Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Nicolas Morey <nmorey@suse.com> Link: https://patch.msgid.link/20260909160132.1491248-1-nmorey@suse.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-10RDMA/siw: Bound fragmented header copies by the remaining lengthJérémy Jean
siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length. Fixes: 754209850df8 ("RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.") Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Link: https://patch.msgid.link/20260908085520.1746329-1-Jeremy.Jean@oss.cyber.gouv.fr Assisted-by: Codex:gpt-6 Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-10RDMA: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260907065047.26773-2-hemanth.selam@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/rxe: Hold netdev reference for transmit skbsxiongweimin
rxe_init_packet() assigns skb->dev from an RCU-protected GID attribute without holding a netdev reference. If the netdev is unregistered before the skb is freed, subsequent accesses to skb->dev are unsafe. Hold a reference with dev_hold() when the skb is initialized and release it from the transmit destructor or via rxe_put_skb() on error paths that run before the destructor is installed. skb->dev can change on the TX path (VLAN/bond/tunnel, ip_finish_output2, etc.), so put must use the same netdev that was held. Stash that pointer in skb_shinfo()->destructor_arg: skb->cb is already used by rxe_pkt_info and is rewritten by IP control blocks. To avoid blocking netdev unregistration on held skbs, flush all QPs to the error state on NETDEV_GOING_DOWN and NETDEV_UNREGISTER so pending TX work is drained and references can be dropped. Signed-off-by: xiongweimin <xiongweimin@kylinos.cn> Link: https://patch.msgid.link/20260716055255.157674-1-xiongwm2026@163.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeedsMichael Bommarito
rxe_get_mcg() publishes a newly allocated multicast group in rxe->mcg_tree before programming the backing Ethernet multicast address with rxe_mcast_add(), which runs outside mcg_lock. A local userspace RDMA client reaches this path with ATTACH_MCAST on a UD QP; if rxe_mcast_add() then returns an error (for example -ENODEV when the backing netdev has been removed, or a propagated dev_mc_add() error), the unwind frees the published group without removing it from the tree. A later lookup of the same MGID dereferences the freed struct rxe_mcg from __rxe_lookup_mcg(). Fix this by keeping the new mcg private until rxe_mcast_add() succeeds. Split the tree publication into __rxe_publish_mcg(), call rxe_mcast_add() before taking the tree reference, and free the still-private mcg on failure. Because the group is never visible in mcg_tree until the multicast address is programmed, no concurrent caller can look it up or attach a QP to a group that is about to be torn down, so the error path needs no conditional unwind. If another caller publishes the same MGID while the address is being programmed, the post-add re-check under mcg_lock finds the winner; this caller then drops its private object and balances its own rxe_mcast_add() with rxe_mcast_del() before returning the winner. Reproduced by forcing the rxe_mcast_add() error return under KASAN: without the change the next attach to the same MGID reports a slab-use-after-free in __rxe_lookup_mcg(); with it the forced failure returns cleanly. A no-injection attach/detach regression, including a two-QP shared join/leave and re-attach, stays KASAN- and leak-clean. Fixes: a926a903b7dc ("RDMA/rxe: Do not call dev_mc_add/del() under a spinlock") Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260617022728.2770116-1-michael.bommarito@gmail.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write pathsWeiming Shi
Commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages") dropped the access permission test from rxe_check_pagefault() and left only HMM_PFN_VALID. A page faulted in read-only, for example a page-cache folio behind a PROT_READ file mapping, then satisfies the check and ODP write operations (RDMA WRITE, RDMA READ response, SEND payload, atomics) modify it through kmap without ever breaking CoW. An unprivileged user can register an ODP MR over such a mapping and have incoming RDMA traffic overwrite the page cache of a file it only holds O_RDONLY, including /etc/passwd or setuid binaries. This is the same primitive class as Dirty COW and CVE-2022-2590. mlx5 has the missing invariant: its ODP path sets the device write bit only for pfns that carry HMM_PFN_WRITE. Restore it in rxe by requiring HMM_PFN_WRITE in rxe_check_pagefault() for every operation except RXE_PAGEFAULT_RDONLY. A write to a non-writable VMA now fails the one fault attempt with -EPERM from hmm_vma_fault() instead of re-faulting forever. For a writable VMA the fault breaks CoW and the write lands in the private page. Keep pmem flushes on the read-only check. arch_wb_cache_pmem() never modifies memory, and the FLUSH access bits do not make the umem writable, so classifying flushes as writes would make every flush against a flush-only MR fail. Fixes: 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages") Signed-off-by: Weiming Shi <bestswngs@gmail.com> Link: https://patch.msgid.link/20260726111533.1037819-1-bestswngs@gmail.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Tested-by: Hongqiang Luo <wanbafv@gmail.com> Tested-by: Xinyu Ma <mmmxny@gmail.com> Tested-by: Zhanbo Ye <cainyzb@gmail.com> Reported-by: Weiming Shi <bestswngs@gmail.com> Reported-by: Shaomin Chen <eeesssooo020@gmail.com> Reported-by: Rui Ding <threonine42@gmail.com> Reported-by: Miao Zhao <muel@nova.gal> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB accessGang Yan
mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic: if (iova < mr->ibmr.iova || iova + length > mr->ibmr.iova + mr->ibmr.length) A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer. Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow: if (iova < mr->ibmr.iova || length > mr->ibmr.length || iova - mr->ibmr.iova > mr->ibmr.length - length) With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB. Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Gang Yan <yangang@kylinos.cn> Link: https://patch.msgid.link/20260814093740.292954-1-gang.yan@linux.dev Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Reviewed-by: Shukai Ni <shukai.ni@kuleuven.be> Tested-by: Shukai Ni <shukai.ni@kuleuven.be> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/rxe: validate access flags before swapping the MR's PDNorbert Szetei
rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then validates the IB_MR_REREG_ACCESS argument: if (flags & IB_MR_REREG_PD) { rxe_put(old_pd); rxe_get(pd); mr->ibmr.pd = ibpd; } if (flags & IB_MR_REREG_ACCESS) { if (access & ~RXE_ACCESS_SUPPORTED_MR) return ERR_PTR(-EOPNOTSUPP); mr->access = access; } Both flags pass the entry check because RXE_MR_REREG_SUPPORTED is IB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access check with mr->ibmr.pd already reassigned. mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the success path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error without undoing the reassignment, so mr->pd == new_pd while the usecnts still charge the MR to orig_pd. ib_dereg_mr_user() then decrements new_pd, whose count can reach zero while a memory window still references it; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup() writes to freed memory: BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0 Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591 __rxe_put+0x31/0xa0 rxe_mw_cleanup+0x42/0x200 __rxe_cleanup+0x115/0x370 rxe_dealloc_mw+0x4c/0x80 Allocated by task 591: ib_uverbs_alloc_pd+0x258/0x540 Freed by task 591: ib_dealloc_pd_user+0x174/0x210 uverbs_free_pd+0x8d/0xc0 ib_uverbs_dealloc_pd+0x18e/0x1d0 Validate the access flags before mutating any state so the callback either applies every requested change or none. Fixes: 544c7f62cf32 ("RDMA/rxe: Implement rereg_user_mr") Signed-off-by: Norbert Szetei <norbert@doyensec.com> Link: https://patch.msgid.link/46E1D5C0-24BE-4D01-BDB3-634FE09B22C5@doyensec.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-01RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_acceptGuoqing Jiang
We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window: siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Link: https://lore.kernel.org/linux-rdma/d6fbe475-a5c2-f975-99b0-a0bd6b6d10e8@linux.dev/T/#m5876c1ff2de8686a9a1173b8f1aa0ff5363a785c Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev> Link: https://patch.msgid.link/20260827125553.12831-1-guoqing.jiang@linux.dev Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-08-21Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull RDMA updates from Jason Gunthorpe: "About the normal size, still a lot of AI bug fixes and so on, but some interesting new functionality too: - Assorted locking, bounds-checking, cleanup, and error-path fixes across UCMA/CMA, bng_re, bnxt_re, cxgb4, EFA, ERDMA, HFI1, HNS, ionic, iRDMA, mlx4/mlx5, RXE, SIW, SRP/SRPT, and iSER target. - netlink report for max # of supported resources - get_zeroed_page()/etc removal - Robust udata for ionic - Allow unique RDMA device names per network namespace - Completion counters and v2 admit queue support for EFA - UC QP support for MANA - Completion timestamps for ionic - Harden uverbs data validation and resource lifetime handling, fixing several core use-after-free conditions. - bnxt_re toggle-page ownership and lifetime bug fixes - dmabuf SRQ support for mlx5" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (160 commits) RDMA/ucma: Allow path records to exactly fit the output buffer RDMA/uverbs: Guard legacy bundles without method_elm RDMA/efa: Add support for 128B admin v2 SQ entry RDMA/efa: Generalize the admin SQ RDMA/efa: Decouple admin command payload from admin header RDMA/rxe: Fix OOB in free_rd_atomic_resources() RDMA/cma: Fix WARNING in res_to_rt RDMA/cxgb4: Free debugfs on registration failure RDMA/cxgb4: Cancel reg_work before freeing device on remove RDMA/ucma: Lock the handler in ucma_set_ib_path() RDMA/ucma: Lock the handler in ucma_write_cm_event() RDMA/erdma: restrict the driver to little-endian systems RDMA/ionic: Embed counter driver data in rdma_counter allocation RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget RDMA/siw: Fix use-after-free in siw_accept() IB/isert: post the full-feature receive buffers after session registration IB/isert: delay the final Login Response until the session is registered RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ RDMA/erdma: Hold QP references for AE and CM processing RDMA/erdma: Hold CQ references when processing EQ events ...
2026-08-18Merge rdma branch 'for-rc' into 'for-next'Jason Gunthorpe
These did not seem worth sending as a dedicated rc PR during the last week of the cycle. * ko-rdma/for-rc: RDMA/ipoib: Drain RCU callbacks during module teardown RDMA/mlx5: Drain RCU callbacks during module teardown RDMA/core: Wait for RCU callbacks before unloading ib_core RDMA/irdma: Prevent overflows in memory contiguity checks RDMA/siw: publish QP after initialization RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe RDMA/mana_ib: initialize err for empty send WR lists RDMA/erdma: initialize ret for empty receive WR lists RDMA/irdma: Prevent user-triggered null deref on QP create RDMA/irdma: Prevent rereg_mr for non-mem regions RDMA/cma: Fix hardware address comparison length in netevent callback RDMa/mlx5: Avoid frame overflow warning IB/mad: Drop unmatched RMPP responses before reassembly Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-12RDMA/rxe: Fix OOB in free_rd_atomic_resources()Peiyang He
free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the free path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN: ================================================================== BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063 CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xf7/0x600 mm/kasan/report.c:482 kasan_report+0xe4/0x120 mm/kasan/report.c:595 free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007 RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0 </TASK> Allocated by task 11063: kasan_save_stack+0x33/0x60 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5296 [inline] __kmalloc_noprof+0x32a/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline] rxe_qp_from_attr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:714 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802b8ddd80 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes to the right of allocated 56-byte region [ffff88802b8ddd80, ffff88802b8dddb8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b8dd flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff888015c418c0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4651, tgid 4651 ((udev-worker)), ts 123427165316, free_ts 123425874255 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfc/0x120 mm/page_alloc.c:1853 prep_new_page mm/page_alloc.c:1861 [inline] get_page_from_freelist+0x75b/0x3220 mm/page_alloc.c:3941 __alloc_frozen_pages_noprof+0x27e/0x2b00 mm/page_alloc.c:5221 alloc_slab_page mm/slub.c:3278 [inline] allocate_slab mm/slub.c:3467 [inline] new_slab+0xa6/0x670 mm/slub.c:3525 refill_objects+0x278/0x420 mm/slub.c:7272 refill_sheaf mm/slub.c:2816 [inline] __pcs_replace_empty_main+0x2ed/0x640 mm/slub.c:4652 alloc_from_pcs mm/slub.c:4750 [inline] slab_alloc_node mm/slub.c:4884 [inline] __do_kmalloc_node mm/slub.c:5295 [inline] __kmalloc_noprof+0x68d/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] tomoyo_encode2+0x100/0x3e0 security/tomoyo/realpath.c:45 tomoyo_encode+0x29/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x18c/0x690 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x2ab/0x3c0 security/tomoyo/file.c:776 tomoyo_file_open+0x6b/0x90 security/tomoyo/tomoyo.c:334 security_file_open+0x7a/0x1b0 security/security.c:2739 do_dentry_open+0x57e/0x1690 fs/open.c:924 vfs_open+0x82/0x3f0 fs/open.c:1079 do_open fs/namei.c:4699 [inline] path_openat+0x218a/0x3190 fs/namei.c:4858 page last free pid 1 tgid 1 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x763/0xfc0 mm/page_alloc.c:2938 selinux_genfs_get_sid security/selinux/hooks.c:1364 [inline] inode_doinit_with_dentry+0x903/0x1320 security/selinux/hooks.c:1563 selinux_d_instantiate+0x26/0x30 security/selinux/hooks.c:6658 security_d_instantiate+0x123/0x190 security/security.c:3704 d_splice_alias_ops+0x92/0x850 fs/dcache.c:3141 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1289 lookup_open.isra.0+0x659/0x1080 fs/namei.c:4484 open_last_lookups fs/namei.c:4611 [inline] path_openat+0x17dd/0x3190 fs/namei.c:4855 do_file_open+0x20c/0x430 fs/namei.c:4887 do_sys_openat2+0x101/0x1d0 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x141/0x200 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88802b8ddc80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff88802b8ddd00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88802b8ddd80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ^ ffff88802b8dde00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ffff88802b8dde80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc Fix the OOB by moving the assignment after free_rd_atomic_resources() so the old array is freed using the old bound. This matches the original ordering in commit 8700e3e7c485 ("Soft RoCE driver"). Closes: https://lore.kernel.org/all/365C68B4923F8214+30195a67-0b90-4b92-ab96-2ce41517793c@smail.nju.edu.cn/ Fixes: b6bbee0d2438 ("IB/rxe: Properly honor max IRD value for rd/atomic.") Cc: stable@vger.kernel.org Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-08-06RDMA/siw: Fix use-after-free in siw_accept()Shuangpeng Bai
siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether qp->cep is non-NULL and assumes the current call installed the association. However, qp->cep can point to the CEP of an existing connection. The cleanup then drops a reference from the incoming cep, not qp->cep. Once the incoming endpoint loses its remaining references, this can free it before the subsequent cep->qp store, causing a use-after-free. It also clears the existing QP association. Only release the association reference when qp->cep is the incoming CEP. This preserves an existing association and avoids accessing the freed endpoint. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Link: https://patch.msgid.link/20260801213632.1086548-1-shuangpeng.kernel@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-28RDMA/rxe: Fix UAF in ODP init error-handling pathPeiyang He
rxe_odp_mr_init_user() stores &umem_odp->umem in mr->umem before calling rxe_odp_init_pages(). If rxe_odp_init_pages() fails, rxe_odp_mr_init_user() releases umem_odp and returns an error. rxe_reg_user_mr() then unwinds the error through rxe_cleanup(), rxe_mr_cleanup(), ib_umem_release(mr->umem). There is an IS_ERR_OR_NULL(umem) check at the start of ib_umem_release(). But since mr->umem is NOT reset to NULL in the error handling path of rxe_odp_mr_init_user(), the check passes and it reads already-freed fields like umem->is_dmabuf, causing UAF. Fix the UAF by clearing mr->umem after releasing the failed ODP umem so the MR cleanup path does not release it again. Fixes: d03fb5c6599e ("RDMA/rxe: Allow registering MRs for On-Demand Paging") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Link: https://patch.msgid.link/70CB6DBCB19624C7+20260727050659.1543627-1-peiyang_he@smail.nju.edu.cn Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Implement disassociate_ucontext callbackJiri Pirko
Implement an empty disassociate_ucontext() callback so the RDMA core can move rxe devices between net namespaces. The core requires this callback to reset user contexts without waiting for userspace. rxe needs no teardown here: its user-mapped queues live in reference-counted vmalloc memory (see rxe_mmap.c) that stays valid while userspace holds the mappings. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-14-jiri@resnulli.us Reviewed-by: Yanjun Zhu <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Allow queue VMAs to outlive ucontextsJiri Pirko
Prepare queue mappings for asynchronous ucontext disassociation during device disable. Rely on the VMA page references to preserve mapped memory until the final unmap. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-13-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22Merge branch 'big-tcp-for-udp-tunnels'Paolo Abeni
Alice Mikityanska says: ==================== BIG TCP for UDP tunnels This series is a follow-up to "BIG TCP without HBH in IPv6", and it adds support for BIG TCP IPv4/IPv6 workloads in vxlan and geneve. Now that IPv6 BIG TCP doesn't require stripping the HBH in all various combinations in tunneled traffic, adding BIG TCP becomes feasible. Patch 01 adds accessors for the length field in the UDP header, as suggested by Paolo in review. The usage of udp_set_len is then added in the following patches that start using length=0 in BIG TCP UDP packets. Patches 02-04 close the gaps that prevent BIG TCP packets from going through UDP tunnel code. Patch 05 validates packets in udp_gro_receive to exclude packets with length=0 from GRO aggregation. Patch 06 is for proper formatting in tcpdump (set UDP len to 0 rather than a trimmed value on overflow). Patches 07-08 bump up tso_max_size for VXLAN and GENEVE. Patch 09 adds selftests. ====================$ Link: https://patch.msgid.link/20260710134242.216538-1-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-22net: Use helpers to get/set UDP len tree-wideAlice Mikityanska
Since BIG TCP for UDP tunnels will start using len=0 in the UDP header as an indicator of a GSO packet bigger than 65535 bytes, this commit introduces the following getter and setters to use tree-wide, in order to explicitly mark places where len=0 may be expected, and handle them properly: 1. udp_set_len() sets uh->len to its real value if it's not bigger than 65535, and to 0 otherwise: to be used in GSO context with aggregated packets. 2. udp_set_len_short() is to be used when the length is known to fit 16 bits. It WARNs when the caller tries to assign a bigger value if CONFIG_DEBUG_NET=y. 3. udp_get_len_short() returns len in host byte order: to be used on the RX side to deal with non-aggregated packets, or to access the raw value of the len field. 4. udp_get_len() decodes uh->len set by udp_set_len(). It checks whether the packet is GSO to guard from malformed packets. At the moment udp_set_len() is not used, a following commit will start using it after enabling len>65535 for GSO. Raw uh->len (in network byte order) is still accessed in a few places for checksum calculation purposes, and to decode len=0 in udpv6_rcv for jumbograms. udp_rcv and udpv6_rcv will be addressed by the commit that starts using udp_set_len() to set UDP len=0 for BIG TCP packets in UDP tunnels. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Acked-by: Jason A. Donenfeld <Jason@zx2c4.com> Link: https://patch.msgid.link/20260710134242.216538-2-alice.kernel@fastmail.im Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-20RDMA: Use ib_no_udata_io() in query_device callbacksLeon Romanovsky
The query_device callbacks that neither accept driver-specific input nor return a driver-specific response open-code the empty udata handling as ib_is_udata_in_empty() on entry and ib_respond_empty_udata() on exit. ib_no_udata_io() already combines both steps, so replace the entry check with it and simply return 0 on success. Unlike the create and destroy flows, query_device owns no uobject or HW resource - the extended path fills a stack ib_device_attr that the core discards on error - so clearing the empty response buffer on entry rather than on exit is a mechanical change with no functional difference. Link: https://patch.msgid.link/20260714-convert-to-noio-udata-v1-1-f1f6b6c7c988@nvidia.com Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-07-20RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]Ibrahim Hashimov
For a user QP, qp->sq.queue is a ring the application writes directly, so rxe_post_send() takes the is_user branch and only schedules send_task without validating the WQE. rxe_requester() consumes it in place via req_next_wqe() and calls copy_data(), which indexes &wqe->dma.sge[cur_sge] with the attacker-controlled num_sge/cur_sge. Only the kernel path bounds num_sge (validate_send_wr()); the user WQE is never checked, so a local unprivileged user can post a WQE with an out-of-range cur_sge or oversized num_sge and force an out-of-bounds read of the per-WQE sge array in copy_data() (vmalloc OOB read, local DoS). Bound num_sge to qp->sq.max_sge in rxe_requester() before use, the way get_srq_wqe() already guards SRQ entries, and bound cur_sge only when the WQE carries payload (dma.resid): copy_data() returns early on a zero-length copy before touching dma->sge[], so a zero-payload WQE -- the only kind a max_sge == 0 QP can post -- stays valid. Reproduced under KASAN; the vmalloc-out-of-bounds in copy_data() is gone. Fixes: 8700e3e7c485 ("Soft RoCE driver") Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Ibrahim Hashimov <security@auditcode.ai> Link: https://patch.msgid.link/20260712122149.78142-1-security@auditcode.ai Assisted-by: AuditCode-AI:2026.07 Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-20RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qpIbrahim Hashimov
rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while the responder task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting only that attribute calls free_rd_atomic_resources() then alloc_rd_atomic_resources(), swapping qp->resp.resources[] while rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources() also leaves the cached pointer qp->resp.res dangling. A local unprivileged user can race the free/realloc into a use-after-free in rxe_receiver() (local DoS). Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(), as rxe_qp_reset() already does when tearing this array down, re-enabling only after alloc_rd_atomic_resources() succeeds so the responder never resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear qp->resp.res in free_rd_atomic_resources(), like the rxe_resp.c completion paths. Reproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone. Fixes: 8700e3e7c485 ("Soft RoCE driver") Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Ibrahim Hashimov <security@auditcode.ai> Link: https://patch.msgid.link/20260712121720.78001-1-security@auditcode.ai Assisted-by: AuditCode-AI:2026.07 Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-15RDMA/rxe: Reject unimplemented implicit ODP cleanlyxiongweimin
rxe advertises ODP but not IB_ODP_SUPPORT_IMPLICIT. The reg_user_mr path still contained a dead branch that checked the implicit capability and could never succeed. Return -EOPNOTSUPP for the implicit ODP address range up front so the intent is obvious and the unreachable code is gone. Signed-off-by: xiongweimin <xiongweimin@kylinos.cn> Cc: linux-rdma@vger.kernel.org Cc: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/20260713010439.331054-1-15927021679@163.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-14IB/rdmavt: use kzalloc() to allocate QPN-map pagesMike Rapoport (Microsoft)
get_map_page() allocates bitmap pages using get_zeroed_page(). The bitmaps can be allocated with kmalloc() as there's nothing special about them to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Performance difference between kmalloc() and __get_free_pages() is not measurable as both allocators take an object/page from a per-CPU list for fast path allocations. For the slow path the performance is anyway determined by the amount of reclaim involved rather than by what allocator is used. Replace use of get_zeroed_page() with kzalloc() and free_page() with kfree(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Link: https://patch.msgid.link/20260713-b4-rdma-v2-5-65d2a1a5180c@kernel.org Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-14RDMA: Remove redundant memset() from query_device callbacksLeon Romanovsky
The core always hands the driver's query_device() callback a zeroed ib_device_attr. There are only two callers of the op and both clear the structure before invoking it: setup_device() memsets &device->attrs, and ib_uverbs_ex_query_device() passes an on-stack structure initialized to {}. The open-coded memset(props, 0, sizeof(*props)) at the top of the driver callbacks is therefore redundant. Remove it from all drivers. Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-07-13RDMA/rvt: Return NULL after port allocation failureLeon Romanovsky
rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free. Return NULL immediately after deallocation so callers can propagate the allocation failure. Fixes: ff6acd69518e ("IB/rdmavt: Add device structure allocation") Link: https://patch.msgid.link/20260708-clean-init-one-hfi1-v1-1-b9e9641268a5@nvidia.com Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-07-12RDMA/rxe: Avoid reprocessing the current packet after the QP enters the ↵Allison Henderson
error state When do_complete() finds the QP in the error state it returns RESPST_CHK_RESOURCE. Before commit 49dc9c1f0c7e ("RDMA/rxe: Cleanup reset state handling in rxe_resp.c") this was the flush loop: check_resource() had an error-state branch that fetched each remaining recv WQE and completed it with IB_WC_WR_FLUSH_ERR, without touching the current packet. That commit removed the error-state branch from check_resource() (draining is now done at rxe_receiver() entry) but kept the do_complete() error-state return. As a result, when a QP moves to the error state while a packet is being completed - e.g. an rdma_cm disconnect racing with receive processing - the responder state machine loops back into the request processing chain with the already-completed packet still in hand: check_resource() fetches a fresh recv WQE, execute()/send_data_in() copies the same packet payload again, do_complete() posts another IB_WC_SUCCESS CQE (qp->resp.status is still 0), and control returns to the error-state check. The loop re-executes the same packet once per posted recv WQE (observed: ~1000 duplicate IB_WC_SUCCESS completions of one SEND, one per ~8us, matching the RQ occupancy) until the RQ is exhausted, after which qp->resp.wqe is NULL and send_data_in() dereferences it: BUG: kernel NULL pointer dereference, address: 0000000000000014 Workqueue: rxe_wq do_work RIP: copy_data+0x29/0x1f0 Call Trace: send_data_in+0x25/0x50 rxe_receiver+0xf36/0x1dd0 The duplicate completions are indistinguishable from real receives to the ULP. During an rds stress test, the message was accepted as new and delivered the same datagram to user space hundreds of times, corrupting the stream; any ULP that relies on RC exactly-once delivery is affected. A live packet reaching the error-state check in do_complete() has been executed and completed exactly once and must be consumed, not re-processed. Return RESPST_CLEANUP for it (dequeue and free); keep returning RESPST_CHK_RESOURCE for the pkt == NULL case. Fixes: 49dc9c1f0c7e ("RDMA/rxe: Cleanup reset state handling in rxe_resp.c") Assisted-by: Claude-Code:claude-fable-5 Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260711165419.13486-1-achender@kernel.org Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-12RDMA: Change capability fields in ib_device_attr from int to u32Erni Sri Satya Vennela
The capability counter fields in struct ib_device_attr are declared as signed int, but these values are inherently non-negative. Drivers maintain their cached caps as u32 and assign them directly into these int fields; if a cap exceeds INT_MAX the implicit narrowing yields a negative value visible to the IB core. Change the signed int capability fields to u32 to match the underlying nature of the data. Also update consumers across the IB core, ULPs, NVMe-oF target, RDS, and NFS/RDMA so the new u32 values are not forced back through signed int or u8 via min()/min_t() or narrowing local variables. The nvmet-rdma consumer of max_srq clamps it against ib_device.num_comp_vectors, which stays a signed int, so that site uses min_t() instead of min() to handle the signed/unsigned mismatch. Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com> Link: https://patch.msgid.link/20260709055211.2498307-1-ernis@linux.microsoft.com Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Stefan Metzmacher <metze@samba.org> # smbdirect Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-05RDMA/rxe: Check PDs for memory window bindsZhiwei Zhang
The IBTA Software Transport Verbs specification requires the QP, Memory Window and Memory Region for a Bind Memory Window operation to belong to the same HCA and protection domain. rxe only checked the QP and MW protection domain for type 2 MWs. Move the QP/MW PD check to the common bind path and also reject binding an MW to an MR from a different PD. Invalid bind requests continue to fail with IB_WC_MW_BIND_ERR. Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Zhiwei Zhang <202275009@qq.com> Link: https://patch.msgid.link/tencent_FD4FB25AA4FFA845E63F5AC36CF4A46CDC0A@qq.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-02RDMA/siw: publish QP after initializationRuoyu Wang
siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed. Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list. Fixes: f29dd55b0236 ("rdma/siw: queue pair methods") Link: https://patch.msgid.link/r/20260630060040.966461-1-ruoyuw560@gmail.com Suggested-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-18Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma updates from Jason Gunthorpe: "Many AI driven bug fixes, and several big driver API cleanups - Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw, rtrs, mana, irdma, mlx4. Commonly error path flows, integer arithmetic overflows on unsafe data, out of bounds access, and use after free issues under races. - Second half of the new udata API for drivers focusing on uAPI response - bnxt_re supports more options for QP creation that will allow a dv path in rdma-core - Untangle the module dependencies so drivers don't link to ib_uverbs.ko as was originall intended - Provide a new way to handle umems with a consistent simplified uAPI and update several drivers to use it. This brings dmabuf support to more places and more drivers - Support for mlx5 rate limit and packet pacing for UD and UC - A batch of fixes for the new shared FRMR pools infrastructure" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (148 commits) RDMA/irdma: Replace waitqueue and flag with completion RDMA/hns: Fix memory leak of bonding resources RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg docs: infiniband: correct name of option to enable the ib_uverbs module RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled RDMA/bnxt_re: Avoid repeated requests to allocate WC pages RDMA/bnxt_re: Proper rollback if the ioremap fails RDMA/bnxt_re: Add a max slot check for SQ RDMA/bnxt_re: Avoid displaying the kernel pointer RDMA/bnxt_re: Free CQ toggle page after firmware teardown RDMA/bnxt_re: Free SRQ toggle page after firmware teardown RDMA/bnxt_re: Initialize dpi variable to zero ABI: sysfs-class-infiniband: minor cleanup RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one RDMA/mlx5: Fix undefined shift of user RQ WQE size RDMA/mlx5: Remove raw RSS QP restrack tracking RDMA/mlx5: Remove DCT restrack tracking RDMA/mlx5: Drop FRMR pool handle on UMR revoke failure RDMA/core: Add ib_frmr_pool_drop for unrecoverable handles ...
2026-06-11Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.1-rc8). Conflicts: drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c f67aead16e85 ("net: txgbe: rework service event handling") 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") net/rds/info.c 512db8267b73 ("rds: mark snapshot pages dirty in rds_info_getsockopt()") 6e94eeb2a2a6 ("rds: convert to getsockopt_iter") Adjacent changes: include/net/sock.h 1ee90b77b727 ("net: guard timestamp cmsgs to real error queue skbs") f0de88303d5e ("net: make is_skb_wmem() available to modules") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-08RDMA: During rereg_mr ensure that REREG_ACCESS is compatibleJason Gunthorpe
If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be re-evaluated to ensure it is properly pinned as RW. Since the umem is hidden inside each driver's mr struct add a ib_umem_check_rereg() function that each driver has to call before processing IB_MR_REREG_ACCESS. mlx4 has to retain its duplicate ib_access_writable check because it implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items in place sequentially while the MR is live, so it will continue to not support this combination. Cc: stable@vger.kernel.org Fixes: b40656aa7d55 ("RDMA/umem: remove FOLL_FORCE usage") Link: https://patch.msgid.link/r/0-v1-06fb1a2d6cf5+107-rereg_access_jgg@nvidia.com Reported-by: Philip Tsukerman <philiptsukerman@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-05RDMA/siw: Fix endpoint/socket association handlingBernard Metzler
Disassociating a socket from an endpoint via siw_socket_disassoc() may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer after calling that function, but within. This fixes a: BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075) which occurred after processing a malformed MPA request during connection establishment, causing the new endpoint to be closed. Fixes: 6c52fdc244b5c ("rdma/siw: connection management") Link: https://patch.msgid.link/r/20260604160808.30948-1-bernard.metzler@linux.dev Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-05RDMA/siw: bound Read Response placement to the RREAD lengthMichael Bommarito
In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siw_check_sge() resolves and validates the sink memory only on the first fragment (the if (!*mem) branch), and siw_rresp_check_ntoh() compares the cumulative length against wqe->bytes only on the final segment (the !frx->more_ddp_segs guard). A connected siw peer that answers an outstanding RREAD with Read Response segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives wqe->processed past the validated sink buffer; the next siw_rx_data() call writes out of bounds at sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of an established RDMA connection and needs no local privilege. Bound every segment before placement, exactly as siw_proc_send() and siw_proc_write() already do for their tagged and untagged paths, and terminate the connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer. This is the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that underflows the per-fragment remainder in the header decode; that guard does not cover this case, because here each individual segment length is self-consistent and only the accumulated placement offset overruns the buffer. Fixes: 8b6a361b8c48 ("rdma/siw: receive path") Link: https://patch.msgid.link/r/20260602194700.2273758-1-michael.bommarito@gmail.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
generated by cgit v1.2.3 (git 2.0.4) at 2026-11-08 14:03:21 +0000