Re: [PATCH] RDMA/irdma: avoid use-after-free in icrdma_remove

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double deinitialization and use-after-free bugs in probe error paths when device registration fails.
--

commit 0724e8fb174ff83ee96cc996862eceaebf99da69
Author: Guangshuo Li <lgs201920130244@gmail.com>

RDMA/irdma: avoid use-after-free in icrdma_remove

icrdma_remove() accesses iwdev after calling irdma_ib_unregister_device(),
which could lead to a use-after-free. This patch fixes the issue by
saving the iwdev->rf pointer before unregistering the device and using it
for the remaining cleanup.

> diff --git a/drivers/infiniband/hw/irdma/icrdma_if.c b/drivers/infiniband/hw/irdma/icrdma_if.c
> index 4b451d8482a48..f405ef761f843 100644
> --- a/drivers/infiniband/hw/irdma/icrdma_if.c
> +++ b/drivers/infiniband/hw/irdma/icrdma_if.c
> @@ -318,14 +318,15 @@ static void icrdma_remove(struct auxiliary_device *aux_dev)
>  		container_of(aux_dev, struct iidc_rdma_core_auxiliary_dev, adev);
>  	struct iidc_rdma_core_dev_info *cdev_info = idc_adev->cdev_info;
>  	struct irdma_device *iwdev = auxiliary_get_drvdata(aux_dev);
> -	u8 rdma_ver = iwdev->rf->rdma_ver;
> +	struct irdma_pci_f *rf = iwdev->rf;
> +	u8 rdma_ver = rf->rdma_ver;
>  
>  	ice_rdma_update_vsi_filter(cdev_info, iwdev->vsi_num, false);
>  	irdma_ib_unregister_device(iwdev);
> -	icrdma_deinit_interrupts(iwdev->rf, cdev_info);
> -	mutex_destroy(&iwdev->rf->ah_tbl_lock);
> +	icrdma_deinit_interrupts(rf, cdev_info);
> +	mutex_destroy(&rf->ah_tbl_lock);
>  
> -	kfree(iwdev->rf);
> +	kfree(rf);

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a similar issue
in the device probe functions in this driver.

If irdma_ib_register_device() fails, the error paths perform manual
cleanup and then call ib_dealloc_device().

For example, in icrdma_probe():

err_init_interrupts:
	mutex_destroy(&rf->ah_tbl_lock);
	kfree(rf);
	ib_dealloc_device(&iwdev->ibdev);

Since irdma_ib_register_device() sets .dealloc_driver =
irdma_ib_dealloc_device before attempting registration, does calling
ib_dealloc_device() here invoke irdma_ib_dealloc_device() using the
freed rf pointer, leading to a use-after-free and double-free?

Does this same pattern cause a similar use-after-free in i40iw_open()
(in drivers/infiniband/hw/irdma/i40iw_if.c) and a redundant call to
irdma_rt_deinit_hw() in ig3rdma_vport_probe() (in
drivers/infiniband/hw/irdma/main.c) resulting in a double-free of
iwdev->vsi.pestat and double-destroy of iwdev->cleanup_wq?

>  
>  	pr_debug("INIT: Gen[%d] func[%d] device remove success\n",
>  		 rdma_ver, PCI_FUNC(cdev_info->pdev->devfn));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914122840.1709743-1-lgs201920130244@gmail.com?part=1