Re: [PATCH for-rc] RDMA/hns: Fix the use of uninitialized variable

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free of `net_device` due to unprotected pointer usage outside RCU critical section.
--

commit 473405cc107e96081de8e48759f57372e36d66e0
Author: Junxian Huang <huangjunxian6@hisilicon.com>

RDMA/hns: Fix the use of uninitialized variable

The variable 'i' is used without being initialized in active-backup
mode.

> diff --git a/drivers/infiniband/hw/hns/hns_roce_bond.c b/drivers/infiniband/hw/hns/hns_roce_bond.c
> index f2b12ae13a584..21de82b864d30 100644
> --- a/drivers/infiniband/hw/hns/hns_roce_bond.c
> +++ b/drivers/infiniband/hw/hns/hns_roce_bond.c
> @@ -81,7 +81,7 @@ static int hns_roce_set_bond_netdev(struct hns_roce_bond_group *bond_grp,
>  {
>  	struct net_device *active_dev;
>  	struct net_device *old_dev;
> -	int i, ret = 0;
> +	int i = 0, ret = 0;
>  
>  	if (bond_grp->tx_type == NETDEV_LAG_TX_TYPE_ACTIVEBACKUP) {
>  		rcu_read_lock();
>  		active_dev =
>  			bond_option_active_slave_get_rcu(netdev_priv(bond_grp->upper_dev));
>  		rcu_read_unlock();

[Severity: High]
This isn't a bug introduced by this patch, but does dropping the RCU read
lock here without first acquiring a reference to active_dev leave the pointer
unprotected against concurrent freeing?

>  	} else {
>  		for (i = 0; i < ROCE_BOND_FUNC_MAX; i++) {
>  			active_dev = bond_grp->bond_func_info[i].net_dev;
>  			if (active_dev &&
>  			    ib_get_curr_port_state(active_dev) == IB_PORT_ACTIVE)

[Severity: High]
Similarly, in this fallback branch, an unprotected pointer is read from the
array without locks or reference counts. Can passing it to
ib_get_curr_port_state() result in accessing fields of a freed pointer?

>  				break;
>  		}
>  	}
> 
>  	if (!active_dev || i == ROCE_BOND_FUNC_MAX)
>  		active_dev = get_hr_netdev(hr_dev, 0);
> 
>  	old_dev = ib_device_get_netdev(&hr_dev->ib_dev, 1);
>  	if (old_dev == active_dev)
>  		goto out;
> 
>  	ret = ib_device_set_netdev(&hr_dev->ib_dev, active_dev, 1);

[Severity: High]
Could this pass a dangling active_dev pointer to the core RDMA API, which
attempts to take a reference via netdev_hold()? If a slave device is
concurrently unregistered by an admin while the hns_roce_bond_work workqueue
executes (since the workqueue isn't protected by the RTNL lock), it appears
this might lead to a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914024800.132429-1-huangjunxian6@hisilicon.com?part=1