[PATCH rdma-next 0/3] Various core fixes spotted by LLMs

[PATCH rdma-next 0/3] Various core fixes spotted by LLMs

[Leon Romanovsky]

A batch of core fixes for various issues identified by LLMs.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
Leon Romanovsky (3):
      RDMA/core: Preserve the selected source GID on failed AH modification
      RDMA/core: Free unpublished port statistics after initial-read failure
      RDMA/core: Reject LAG selection when source MAC lookup fails

 drivers/infiniband/core/lag.c   | 12 ++++++++----
 drivers/infiniband/core/sysfs.c |  9 +++++++--
 drivers/infiniband/core/verbs.c |  3 ++-
 3 files changed, 17 insertions(+), 7 deletions(-)
---
base-commit: 66196a559be5963b1ced18418c876caf9bfb76e6
change-id: 20261015-ib-core-fixes-fa78b7068672

Best regards,
--  
Leon Romanovsky <leonro@nvidia.com>

[PATCH rdma-next 1/3] RDMA/core: Preserve the selected source GID on failed AH modification

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

When an address-handle modification fails, the core replaces its source-GID
reference. The old address then loses the reference which keeps its source
entry alive.

Fixes: 1a1f460ff151 ("RDMA: Hold the sgid_attr inside the struct ib_ah/qp")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/core/verbs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index edf62652f9d3..7d52d3036208 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1011,7 +1011,8 @@ int rdma_modify_ah(struct ib_ah *ah, struct rdma_ah_attr *ah_attr)
 		ah->device->ops.modify_ah(ah, ah_attr) :
 		-EOPNOTSUPP;
 
-	ah->sgid_attr = rdma_update_sgid_attr(ah_attr, ah->sgid_attr);
+	if (!ret)
+		ah->sgid_attr = rdma_update_sgid_attr(ah_attr, ah->sgid_attr);
 	rdma_unfill_sgid_attr(ah_attr, old_sgid_attr);
 	return ret;
 }

-- 
2.55.0

[PATCH rdma-next 2/3] RDMA/core: Free unpublished port statistics after initial-read failure

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

An initial port counter read can fail after allocating its statistics
buffer and wrapper. Free these both allocations.

Fixes: 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/core/sysfs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 69df8b703cbd..4cd861b5d953 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -996,8 +996,8 @@ static int setup_hw_port_stats(struct ib_port *port,
 					    data->stats->num_counters);
 	if (ret != data->stats->num_counters) {
 		if (WARN_ON(ret >= 0))
-			return -EINVAL;
-		return ret;
+			ret = -EINVAL;
+		goto err_free_data;
 	}
 
 	data->stats->timestamp = jiffies;
@@ -1031,6 +1031,11 @@ static int setup_hw_port_stats(struct ib_port *port,
 
 	port->hw_stats_data = data;
 	return 0;
+
+err_free_data:
+	rdma_free_hw_stats_struct(data->stats);
+	kfree(data);
+	return ret;
 }
 
 struct rdma_hw_stats *ib_get_hw_stats_port(struct ib_device *ibdev,

-- 
2.55.0

[PATCH rdma-next 3/3] RDMA/core: Reject LAG selection when source MAC lookup fails

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

GID deletion can clear the source device association after LAG lookup
retains the bonding master. Ignoring the resulting L2 lookup failure
copies uninitialized source MAC bytes into the synthetic hash packet.

Read the source MAC before allocating the packet and propagate lookup
errors to the caller, so failed lookups cannot influence slave selection.

Fixes: bd3920eac133 ("RDMA/core: Add LAG functionality")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/core/lag.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/core/lag.c b/drivers/infiniband/core/lag.c
index 88aac911e8ee..651c868aa04e 100644
--- a/drivers/infiniband/core/lag.c
+++ b/drivers/infiniband/core/lag.c
@@ -19,6 +19,11 @@ static struct sk_buff *rdma_build_skb(struct net_device *netdev,
 	u8 smac[ETH_ALEN];
 	bool is_ipv4;
 	int hdr_len;
+	int ret;
+
+	ret = rdma_read_gid_l2_fields(ah_attr->grh.sgid_attr, NULL, smac);
+	if (ret)
+		return ERR_PTR(ret);
 
 	is_ipv4 = ipv6_addr_v4mapped((struct in6_addr *)ah_attr->grh.dgid.raw);
 	hdr_len = ETH_HLEN + sizeof(struct udphdr) + LL_RESERVED_SPACE(netdev);
@@ -26,7 +31,7 @@ static struct sk_buff *rdma_build_skb(struct net_device *netdev,
 
 	skb = alloc_skb(hdr_len, flags);
 	if (!skb)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	skb->dev = netdev;
 	skb_reserve(skb, hdr_len);
@@ -70,7 +75,6 @@ static struct sk_buff *rdma_build_skb(struct net_device *netdev,
 	skb_reset_mac_header(skb);
 	eth = eth_hdr(skb);
 	skb->protocol = eth->h_proto = htons(is_ipv4 ? ETH_P_IP : ETH_P_IPV6);
-	rdma_read_gid_l2_fields(ah_attr->grh.sgid_attr, NULL, smac);
 	memcpy(eth->h_source, smac, ETH_ALEN);
 	memcpy(eth->h_dest, ah_attr->roce.dmac, ETH_ALEN);
 
@@ -86,8 +90,8 @@ static struct net_device *rdma_get_xmit_slave_udp(struct ib_device *device,
 	struct sk_buff *skb;
 
 	skb = rdma_build_skb(master, ah_attr, flags);
-	if (!skb)
-		return ERR_PTR(-ENOMEM);
+	if (IS_ERR(skb))
+		return ERR_CAST(skb);
 
 	rcu_read_lock();
 	slave = netdev_get_xmit_slave(master, skb,

-- 
2.55.0

Re: [PATCH rdma-next 2/3] RDMA/core: Free unpublished port statistics after initial-read failure

[sashiko-bot]

> From: Leon Romanovsky <leonro@nvidia.com>
> 
> An initial port counter read can fail after allocating its statistics
> buffer and wrapper. Free these both allocations.
> 
> Fixes: 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes")
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-ib-core-fixes-v1-0-60f6da3ddec3@nvidia.com?part=2

Re: [PATCH rdma-next 1/3] RDMA/core: Preserve the selected source GID on failed AH modification

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rdma: memory leak and UAF due to missing sgid_attr refcount in rvt_modify_ah()
--

commit cfb0c41a87200fc5df90876398650807044c23ad
Author: Leon Romanovsky <leon@kernel.org>

RDMA/core: Preserve the selected source GID on failed AH modification

When an address-handle modification fails, the core replaces its source-GID
reference. This commit ensures the selected source GID is preserved by only
updating ah->sgid_attr when the modification is successful.

> diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
> index edf62652f9d3e..7d52d30362087 100644
> --- a/drivers/infiniband/core/verbs.c
> +++ b/drivers/infiniband/core/verbs.c
> @@ -1011,7 +1011,8 @@ int rdma_modify_ah(struct ib_ah *ah, struct rdma_ah_attr *ah_attr)
>  		ah->device->ops.modify_ah(ah, ah_attr) :
>  		-EOPNOTSUPP;
>  
> -	ah->sgid_attr = rdma_update_sgid_attr(ah_attr, ah->sgid_attr);
> +	if (!ret)
> +		ah->sgid_attr = rdma_update_sgid_attr(ah_attr, ah->sgid_attr);
>  	rdma_unfill_sgid_attr(ah_attr, old_sgid_attr);

[Severity: High]
Does this sequence expose a memory leak and use-after-free in providers
that do a shallow copy of ah_attr?

For example, in drivers/infiniband/sw/rdmavt/ah.c:rvt_modify_ah(), the
structure is shallowly copied:

	ah->attr = *ah_attr;

This causes a memory leak of the old sgid_attr reference because
rdma_put_gid_attr() is not called on the old pointer, and it adopts the
new sgid_attr without incrementing its refcount.

When rdma_modify_ah() finishes, it calls rdma_unfill_sgid_attr() which
drops the temporary refcount that rvt_modify_ah() copied but didn't pin.
This leaves the driver's ah->attr exposed to a dangling pointer.

Later, rvt_destroy_ah() will unconditionally call:

	rdma_destroy_ah_attr(&ah->attr);

This calls rdma_put_gid_attr() on the unheld pointer, resulting in a
refcount underflow and use-after-free.

This path is concretely reachable via the hfi1 provider (for instance,
hfi1_modify_qp0_ah() uses rdma_modify_ah() with IB_AH_GRH enabled). 

Should providers like rdmavt be updated to use rdma_replace_ah_attr()
to properly manage these refcounts?

>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-ib-core-fixes-v1-0-60f6da3ddec3@nvidia.com?part=1

Re: [PATCH rdma-next 3/3] RDMA/core: Reject LAG selection when source MAC lookup fails

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] rdma: KMSAN uninit-value in rdma_build_skb due to partial header init
--

commit fe2a587fde347fe9ebd760de282337658857e55d
Author: Leon Romanovsky <leon@kernel.org>

RDMA/core: Reject LAG selection when source MAC lookup fails

GID deletion can clear the source device association after LAG lookup
retains the bonding master. Ignoring the resulting L2 lookup failure
copies uninitialized source MAC bytes into the synthetic hash packet.
This commit reads the source MAC before allocating the packet and
propagates lookup errors to the caller.

> diff --git a/drivers/infiniband/core/lag.c b/drivers/infiniband/core/lag.c
> index 88aac911e8ee1..651c868aa04e5 100644
> --- a/drivers/infiniband/core/lag.c
> +++ b/drivers/infiniband/core/lag.c
[ ... ]
> @@ -26,7 +31,7 @@ static struct sk_buff *rdma_build_skb(struct net_device *netdev,
>  
>  	skb = alloc_skb(hdr_len, flags);
>  	if (!skb)
> -		return NULL;
> +		return ERR_PTR(-ENOMEM);

[Severity: Medium]
Does this code expose uninitialized kernel memory to flow dissectors?

Since alloc_skb() leaves the data buffer uninitialized, bitfield assignments
performed later in rdma_build_skb():

	if (is_ipv4) {
		skb_push(skb, sizeof(struct iphdr));
		skb_reset_network_header(skb);
		iph = ip_hdr(skb);
		iph->frag_off = 0;
		iph->version = 4;
		iph->protocol = IPPROTO_UDP;
		iph->ihl = 0x5;

compile down to read-modify-write instructions. These instructions will read
uninitialized adjacent bits (such as the IPv6 priority field in the
corresponding ipv6 branch) which immediately triggers KMSAN uninit-value
warnings.

Furthermore, fields like iph->tos, iph->ttl, and the UDP checksum remain
completely uninitialized. When this SKB is passed to netdev_get_xmit_slave()
and into __skb_flow_dissect(), a BPF flow dissector attached in the network
namespace could read these uninitialized fields, potentially leaking kernel
memory.

>  
>  	skb->dev = netdev;
>  	skb_reserve(skb, hdr_len);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-ib-core-fixes-v1-0-60f6da3ddec3@nvidia.com?part=3

Re: [PATCH rdma-next 2/3] RDMA/core: Free unpublished port statistics after initial-read failure

[Kalesh Anakkur Purayil]

[-- Attachment #1.1: Type: text/plain, Size: 510 bytes --]

On Thu, Oct 15, 2026 at 5:31 PM Leon Romanovsky <leon@kernel.org> wrote:

> From: Leon Romanovsky <leonro@nvidia.com>
>
> An initial port counter read can fail after allocating its statistics
> buffer and wrapper. Free these both allocations.
>
> Fixes: 467f432a521a ("RDMA/core: Split port and device counter sysfs
> attributes")
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
>


> LGTM,
> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
>
>

-- 
Regards,
Kalesh AP

[-- Attachment #1.2: Type: text/html, Size: 1380 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]