Re: [PATCH] RDMA/mlx5: Unbind data direct device on IB device unregister

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] RDMA/mlx5: Use-After-Free in mlx5r_umr_post_send due to teardown phase inversion
--

commit a526f3c890d0ead88aa1cec9b7e04bfef90a8d6b
Author: Li RongQing <lirongqing@baidu.com>

RDMA/mlx5: Unbind data direct device on IB device unregister

This commit adds a call to mlx5_ib_data_direct_unbind() during IB device
unregister to revoke data-direct MRs and clear the data_direct_dev pointer.

> diff --git a/drivers/infiniband/hw/mlx5/data_direct.c b/drivers/infiniband/hw/mlx5/data_direct.c
> index 93a56ee2c4ef4..66852e83c38d0 100644
> --- a/drivers/infiniband/hw/mlx5/data_direct.c
> +++ b/drivers/infiniband/hw/mlx5/data_direct.c
[ ... ]
> @@ -109,6 +109,7 @@ void mlx5_data_direct_ib_unreg(struct mlx5_ib_dev *ibdev)
>  	mutex_lock(&mlx5_data_direct_mutex);
>  	list_for_each_entry(reg, &mlx5_data_direct_reg_list, list) {
>  		if (reg->ibdev == ibdev) {
> +			mlx5_ib_data_direct_unbind(reg->ibdev);

[Severity: High]
Does this introduce a use-after-free during device teardown?

Looking at the teardown sequence in __mlx5_ib_remove(), device stages are
cleaned up in reverse order. The MLX5_IB_STAGE_PRE_IB_REG_UMR stage is torn
down before MLX5_IB_STAGE_INIT.

During MLX5_IB_STAGE_PRE_IB_REG_UMR cleanup, mlx5r_umr_resource_cleanup()
frees the UMR queue pair:

mlx5r_umr_resource_cleanup() {
    ...
    ib_destroy_qp(dev->umrc.qp);
    ...
}

Later, during MLX5_IB_STAGE_INIT cleanup, mlx5_ib_stage_init_cleanup() calls
mlx5_data_direct_ib_unreg(), which now triggers mlx5_ib_data_direct_unbind().
If there are remaining MRs to revoke, the call chain is:

mlx5_ib_data_direct_unbind()
    mlx5_ib_revoke_data_direct_mrs()
        mlx5r_umr_revoke_mr()
            mlx5r_umr_post_send_wait()

At this point, mlx5r_umr_post_send_wait() will attempt to post a work request
using the already-freed dev->umrc.qp, causing a use-after-free if any
data-direct MRs failed to deregister cleanly.

>  			list_del(&reg->list);
>  			kfree(reg);
>  			goto end;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923081442.2520-1-lirongqing@baidu.com?part=1