Re: [PATCH 6.12.y 2/2] svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails

[Greg KH <greg@kroah.com>]

On Tue, Sep 08, 2026 at 08:36:24PM -0400, Sasha Levin wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
> 
> [ Upstream commit 01500306e1d50de7ca7a2cdcdfa28ac0523eb747 ]
> 
> When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,
> it creates a replacement listener cm_id and returns 1, telling
> the CM core to destroy the old one. If the replacement allocation
> fails, sc_cm_id still points at the old cm_id that the CM core is
> about to destroy. Any subsequent dereference of sc_cm_id --
> such as svc_rdma_detach()'s rdma_disconnect() call -- is a
> use-after-free.
> 
> NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s
> rdma_disconnect() call against NULL so that the listener can
> be torn down safely when the server shuts down.
> 
> Fixes: d1b586e75ec6 ("svcrdma: Handle ADDR_CHANGE CM event properly")
> Cc: stable@vger.kernel.org
> Acked-by: Jeff Layton <jlayton@kernel.org>
> Link: https://patch.msgid.link/20260527-rdma-follow-on-v1-5-1b09bd87b6cd@oracle.com
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> [ added the missing sc_cm_id NULL guard to the existing __svc_rdma_free() cleanup worker. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  net/sunrpc/xprtrdma/svc_rdma_transport.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
> index c8d994272f6f0..aa02c47ae5734 100644
> --- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
> +++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
> @@ -311,6 +311,7 @@ static int svc_rdma_listen_handler(struct rdma_cm_id *cma_id,
>  		if (IS_ERR(listen_id)) {
>  			pr_err("Listener dead, address change failed for device %s\n",
>  				cma_id->device->name);
> +			cma_xprt->sc_cm_id = NULL;
>  		} else
>  			cma_xprt->sc_cm_id = listen_id;
>  		return 1;
> @@ -610,14 +611,20 @@ static void svc_rdma_detach(struct svc_xprt *xprt)
>  	struct svcxprt_rdma *rdma =
>  		container_of(xprt, struct svcxprt_rdma, sc_xprt);
>  
> -	rdma_disconnect(rdma->sc_cm_id);
> +	if (rdma->sc_cm_id)
> +		rdma_disconnect(rdma->sc_cm_id);
>  }
>  
>  static void __svc_rdma_free(struct work_struct *work)
>  {
>  	struct svcxprt_rdma *rdma =
>  		container_of(work, struct svcxprt_rdma, sc_work);
> -	struct ib_device *device = rdma->sc_cm_id->device;
> +	struct ib_device *device;
> +
> +	if (!rdma->sc_cm_id)
> +		goto out_free;
> +
> +	device = rdma->sc_cm_id->device;
>  
>  	/* This blocks until the Completion Queues are empty */
>  	if (rdma->sc_qp && !IS_ERR(rdma->sc_qp))
> @@ -648,6 +655,7 @@ static void __svc_rdma_free(struct work_struct *work)
>  
>  	if (!test_bit(XPT_LISTENER, &rdma->sc_xprt.xpt_flags))
>  		rpcrdma_rn_unregister(device, &rdma->sc_rn);
> +out_free:
>  	kfree(rdma);
>  }
>  
> -- 
> 2.53.0
> 
> 

does not apply :(