[PATCH] RDMA/uverbs: Drop restrack ref on ib_init_ucontext() failure in GET_CONTEXT

[PATCH] RDMA/uverbs: Drop restrack ref on ib_init_ucontext() failure in GET_CONTEXT

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

The UVERBS_METHOD_GET_CONTEXT handler allocates the ucontext via
ib_alloc_ucontext(), which calls rdma_restrack_new() (initialising the
kref to 1) and rdma_restrack_set_name(NULL), the latter attaching the
current task and taking a task_struct reference.  When ib_init_ucontext()
subsequently fails, the error path only does:

	kfree(attrs->context);
	attrs->context = NULL;

without first calling rdma_restrack_put() on &attrs->context->res.  The
kref therefore never reaches zero, restrack_release() is never invoked,
and put_task_struct() is never called, so the task_struct reference taken
during set_name is leaked permanently.

A local user with access to an RDMA device can repeat this path (e.g. by
hitting an RDMA cgroup limit or supplying invalid ucaps) and leak one
task_struct reference per attempt, eventually preventing those processes
from being reaped or exhausting memory.

The legacy ib_uverbs_get_context() path already handles this correctly
at its err_ucontext label, where rdma_restrack_put() precedes kfree().
Mirror that ordering here.

Fixes: a1123418ba10 ("RDMA/uverbs: Add ioctl command to get a device context")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/core/uverbs_std_types_device.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index ce0a7de0..db65032 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -272,6 +272,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_GET_CONTEXT)(
 		return ret;
 	ret = ib_init_ucontext(attrs);
 	if (ret) {
+		rdma_restrack_put(&attrs->context->res);
 		kfree(attrs->context);
 		attrs->context = NULL;
 		return ret;
-- 
2.9.4

Re: [PATCH] RDMA/uverbs: Drop restrack ref on ib_init_ucontext() failure in GET_CONTEXT

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> The UVERBS_METHOD_GET_CONTEXT handler allocates the ucontext via
> ib_alloc_ucontext(), which calls rdma_restrack_new() (initialising the
> kref to 1) and rdma_restrack_set_name(NULL), the latter attaching the
> current task and taking a task_struct reference.  When ib_init_ucontext()
> subsequently fails, the error path only does:
> 
> 	kfree(attrs->context);
> 	attrs->context = NULL;
> 
> without first calling rdma_restrack_put() on &attrs->context->res.  The
> kref therefore never reaches zero, restrack_release() is never invoked,
> and put_task_struct() is never called, so the task_struct reference taken
> during set_name is leaked permanently.
> 
> A local user with access to an RDMA device can repeat this path (e.g. by
> hitting an RDMA cgroup limit or supplying invalid ucaps) and leak one
> task_struct reference per attempt, eventually preventing those processes
> from being reaped or exhausting memory.
> 
> The legacy ib_uverbs_get_context() path already handles this correctly
> at its err_ucontext label, where rdma_restrack_put() precedes kfree().
> Mirror that ordering here.
> 
> Fixes: a1123418ba10 ("RDMA/uverbs: Add ioctl command to get a device context")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916085529.1838-1-lirongqing@baidu.com?part=1

Re: [PATCH] RDMA/uverbs: Drop restrack ref on ib_init_ucontext() failure in GET_CONTEXT

[Leon Romanovsky]

On Wed, 16 Sep 2026 16:55:29 +0800, lirongqing wrote:
> The UVERBS_METHOD_GET_CONTEXT handler allocates the ucontext via
> ib_alloc_ucontext(), which calls rdma_restrack_new() (initialising the
> kref to 1) and rdma_restrack_set_name(NULL), the latter attaching the
> current task and taking a task_struct reference.  When ib_init_ucontext()
> subsequently fails, the error path only does:
> 
> 	kfree(attrs->context);
> 	attrs->context = NULL;
> 
> [...]

Applied, thanks!

[1/1] RDMA/uverbs: Drop restrack ref on ib_init_ucontext() failure in GET_CONTEXT
      https://git.kernel.org/rdma/rdma/c/9dcacdc41083cc

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>