From: sashiko-bot@kernel.org
To: "Jacob Moroni" <jmoroni@google.com>
Cc: linux-rdma@vger.kernel.org
Subject: Re: [PATCH RESEND rdma-next] RDMA/mlx4: Fix stale umem and MTT state after rereg_mr failures
Date: Thu, 29 Oct 2026 14:24:18 +0000 [thread overview]
Message-ID: <sashiko-outbox-189508@kernel.org> (raw)
In-Reply-To: <20261029141634.1557240-1-jmoroni@google.com>
> During rereg_mr, the umem is released in various failure cases
> but mmr->umem was left pointing to a freed umem, so it could end
> up getting double-freed when the MR is finally deregistered, or
> cause a UAF in ib_umem_check_rereg() if another rereg_mr attempt
> is made.
>
> Fix this by setting mmr->umem to NULL after ib_umem_release().
>
> Additionally, when mlx4_mr_rereg_mem_write() fails, mtt.order is
> left set but with an invalid offset, so during dereg,
> mlx4_mtt_cleanup() ends up freeing an MTT range that was never
> allocated. Fix this by resetting mtt.order to -1 in that path.
>
> Fixes: 9376932d0c26 ("IB/mlx4_ib: Add support for user MR re-registration")
> Signed-off-by: Jacob Moroni <jmoroni@google.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261029141634.1557240-1-jmoroni@google.com?part=1
prev parent reply other threads:[~2026-10-29 14:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-29 14:16 [PATCH RESEND rdma-next] RDMA/mlx4: Fix stale umem and MTT state after rereg_mr failures Jacob Moroni
2026-10-29 14:24 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-189508@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=jmoroni@google.com \
--cc=linux-rdma@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.