Re: [PATCH] RDMA/uverbs: Drop restrack ref on ib_init_ucontext() failure in GET_CONTEXT

[sashiko-bot@kernel.org]

> From: Li RongQing <lirongqing@baidu.com>
> 
> The UVERBS_METHOD_GET_CONTEXT handler allocates the ucontext via
> ib_alloc_ucontext(), which calls rdma_restrack_new() (initialising the
> kref to 1) and rdma_restrack_set_name(NULL), the latter attaching the
> current task and taking a task_struct reference.  When ib_init_ucontext()
> subsequently fails, the error path only does:
> 
> 	kfree(attrs->context);
> 	attrs->context = NULL;
> 
> without first calling rdma_restrack_put() on &attrs->context->res.  The
> kref therefore never reaches zero, restrack_release() is never invoked,
> and put_task_struct() is never called, so the task_struct reference taken
> during set_name is leaked permanently.
> 
> A local user with access to an RDMA device can repeat this path (e.g. by
> hitting an RDMA cgroup limit or supplying invalid ucaps) and leak one
> task_struct reference per attempt, eventually preventing those processes
> from being reaped or exhausting memory.
> 
> The legacy ib_uverbs_get_context() path already handles this correctly
> at its err_ucontext label, where rdma_restrack_put() precedes kfree().
> Mirror that ordering here.
> 
> Fixes: a1123418ba10 ("RDMA/uverbs: Add ioctl command to get a device context")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916085529.1838-1-lirongqing@baidu.com?part=1