[PATCH] RDMA/irdma: avoid use-after-free in icrdma_remove

[PATCH] RDMA/irdma: avoid use-after-free in icrdma_remove

[Guangshuo Li]

icrdma_remove() dereferences iwdev after calling
irdma_ib_unregister_device():

  irdma_ib_unregister_device(iwdev)
    -> ib_unregister_device(&iwdev->ibdev)
      -> __ib_unregister_device()
        -> ib_dealloc_device()

irdma registers irdma_ib_dealloc_device() as the dealloc_driver
callback in its ib_device_ops. The RDMA core explicitly documents
ib_unregister_device() that when ops.dealloc_driver is used, ib_dev
will be freed upon return from the function.

The ib_device is embedded in struct irdma_device and iwdev itself was
allocated by ib_alloc_device(irdma_device, ibdev). Consequently, once
irdma_ib_unregister_device() returns, iwdev must no longer be
dereferenced.

However, icrdma_remove() currently accesses iwdev->rf afterwards when
deinitializing interrupts, destroying ah_tbl_lock, and freeing rf.
Although the final ib_device storage is released with kfree_rcu(), the
object lifetime has already ended and callers must not rely on the RCU
grace period to continue dereferencing iwdev.

Save iwdev->rf before unregistering the RDMA device and use the saved
pointer for the remaining cleanup.

This issue was found by manual code inspection.

Fixes: 8498a30e1b94 ("RDMA/irdma: Register auxiliary driver and implement private channel OPs")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/infiniband/hw/irdma/icrdma_if.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/irdma/icrdma_if.c b/drivers/infiniband/hw/irdma/icrdma_if.c
index 4b451d8482a4..f405ef761f84 100644
--- a/drivers/infiniband/hw/irdma/icrdma_if.c
+++ b/drivers/infiniband/hw/irdma/icrdma_if.c
@@ -318,14 +318,15 @@ static void icrdma_remove(struct auxiliary_device *aux_dev)
 		container_of(aux_dev, struct iidc_rdma_core_auxiliary_dev, adev);
 	struct iidc_rdma_core_dev_info *cdev_info = idc_adev->cdev_info;
 	struct irdma_device *iwdev = auxiliary_get_drvdata(aux_dev);
-	u8 rdma_ver = iwdev->rf->rdma_ver;
+	struct irdma_pci_f *rf = iwdev->rf;
+	u8 rdma_ver = rf->rdma_ver;
 
 	ice_rdma_update_vsi_filter(cdev_info, iwdev->vsi_num, false);
 	irdma_ib_unregister_device(iwdev);
-	icrdma_deinit_interrupts(iwdev->rf, cdev_info);
-	mutex_destroy(&iwdev->rf->ah_tbl_lock);
+	icrdma_deinit_interrupts(rf, cdev_info);
+	mutex_destroy(&rf->ah_tbl_lock);
 
-	kfree(iwdev->rf);
+	kfree(rf);
 
 	pr_debug("INIT: Gen[%d] func[%d] device remove success\n",
 		 rdma_ver, PCI_FUNC(cdev_info->pdev->devfn));
-- 
2.43.0

Re: [PATCH] RDMA/irdma: avoid use-after-free in icrdma_remove

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double deinitialization and use-after-free bugs in probe error paths when device registration fails.
--

commit 0724e8fb174ff83ee96cc996862eceaebf99da69
Author: Guangshuo Li <lgs201920130244@gmail.com>

RDMA/irdma: avoid use-after-free in icrdma_remove

icrdma_remove() accesses iwdev after calling irdma_ib_unregister_device(),
which could lead to a use-after-free. This patch fixes the issue by
saving the iwdev->rf pointer before unregistering the device and using it
for the remaining cleanup.

> diff --git a/drivers/infiniband/hw/irdma/icrdma_if.c b/drivers/infiniband/hw/irdma/icrdma_if.c
> index 4b451d8482a48..f405ef761f843 100644
> --- a/drivers/infiniband/hw/irdma/icrdma_if.c
> +++ b/drivers/infiniband/hw/irdma/icrdma_if.c
> @@ -318,14 +318,15 @@ static void icrdma_remove(struct auxiliary_device *aux_dev)
>  		container_of(aux_dev, struct iidc_rdma_core_auxiliary_dev, adev);
>  	struct iidc_rdma_core_dev_info *cdev_info = idc_adev->cdev_info;
>  	struct irdma_device *iwdev = auxiliary_get_drvdata(aux_dev);
> -	u8 rdma_ver = iwdev->rf->rdma_ver;
> +	struct irdma_pci_f *rf = iwdev->rf;
> +	u8 rdma_ver = rf->rdma_ver;
>  
>  	ice_rdma_update_vsi_filter(cdev_info, iwdev->vsi_num, false);
>  	irdma_ib_unregister_device(iwdev);
> -	icrdma_deinit_interrupts(iwdev->rf, cdev_info);
> -	mutex_destroy(&iwdev->rf->ah_tbl_lock);
> +	icrdma_deinit_interrupts(rf, cdev_info);
> +	mutex_destroy(&rf->ah_tbl_lock);
>  
> -	kfree(iwdev->rf);
> +	kfree(rf);

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a similar issue
in the device probe functions in this driver.

If irdma_ib_register_device() fails, the error paths perform manual
cleanup and then call ib_dealloc_device().

For example, in icrdma_probe():

err_init_interrupts:
	mutex_destroy(&rf->ah_tbl_lock);
	kfree(rf);
	ib_dealloc_device(&iwdev->ibdev);

Since irdma_ib_register_device() sets .dealloc_driver =
irdma_ib_dealloc_device before attempting registration, does calling
ib_dealloc_device() here invoke irdma_ib_dealloc_device() using the
freed rf pointer, leading to a use-after-free and double-free?

Does this same pattern cause a similar use-after-free in i40iw_open()
(in drivers/infiniband/hw/irdma/i40iw_if.c) and a redundant call to
irdma_rt_deinit_hw() in ig3rdma_vport_probe() (in
drivers/infiniband/hw/irdma/main.c) resulting in a double-free of
iwdev->vsi.pestat and double-destroy of iwdev->cleanup_wq?

>  
>  	pr_debug("INIT: Gen[%d] func[%d] device remove success\n",
>  		 rdma_ver, PCI_FUNC(cdev_info->pdev->devfn));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914122840.1709743-1-lgs201920130244@gmail.com?part=1

Re: [PATCH] RDMA/irdma: avoid use-after-free in icrdma_remove

[Leon Romanovsky]

On Mon, 14 Sep 2026 20:28:40 +0800, Guangshuo Li wrote:
> icrdma_remove() dereferences iwdev after calling
> irdma_ib_unregister_device():
> 
>   irdma_ib_unregister_device(iwdev)
>     -> ib_unregister_device(&iwdev->ibdev)
>       -> __ib_unregister_device()
>         -> ib_dealloc_device()
> 
> [...]

Applied, thanks!

[1/1] RDMA/irdma: avoid use-after-free in icrdma_remove
      https://git.kernel.org/rdma/rdma/c/8a8088b899e4cd

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>