[PATCH RESEND rdma-next] RDMA/mlx4: Fix stale umem and MTT state after rereg_mr failures

[PATCH RESEND rdma-next] RDMA/mlx4: Fix stale umem and MTT state after rereg_mr failures

[Jacob Moroni]

During rereg_mr, the umem is released in various failure cases
but mmr->umem was left pointing to a freed umem, so it could end
up getting double-freed when the MR is finally deregistered, or
cause a UAF in ib_umem_check_rereg() if another rereg_mr attempt
is made.

Fix this by setting mmr->umem to NULL after ib_umem_release().

Additionally, when mlx4_mr_rereg_mem_write() fails, mtt.order is
left set but with an invalid offset, so during dereg,
mlx4_mtt_cleanup() ends up freeing an MTT range that was never
allocated. Fix this by resetting mtt.order to -1 in that path.

Fixes: 9376932d0c26 ("IB/mlx4_ib: Add support for user MR re-registration")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
---
 drivers/infiniband/hw/mlx4/mr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index a6b4abce1bfe..e7f524c28f1e 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -268,6 +268,8 @@ struct ib_mr *mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, u64 start,
 					      *pmpt_entry);
 		if (err) {
 			ib_umem_release(mmr->umem);
+			mmr->mmr.mtt.order = -1;
+			mmr->umem = NULL;
 			goto release_mpt_entry;
 		}
 		mmr->mmr.iova       = virt_addr;
@@ -277,6 +279,7 @@ struct ib_mr *mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, u64 start,
 		if (err) {
 			mlx4_mr_rereg_mem_cleanup(dev->dev, &mmr->mmr);
 			ib_umem_release(mmr->umem);
+			mmr->umem = NULL;
 			goto release_mpt_entry;
 		}
 	}

base-commit: c3e8e9451e6f1b69f685b75e0fbf14f3d0fb2539
-- 
2.56.0.313.g2479322e68-goog

Re: [PATCH RESEND rdma-next] RDMA/mlx4: Fix stale umem and MTT state after rereg_mr failures

[sashiko-bot]

> During rereg_mr, the umem is released in various failure cases
> but mmr->umem was left pointing to a freed umem, so it could end
> up getting double-freed when the MR is finally deregistered, or
> cause a UAF in ib_umem_check_rereg() if another rereg_mr attempt
> is made.
> 
> Fix this by setting mmr->umem to NULL after ib_umem_release().
> 
> Additionally, when mlx4_mr_rereg_mem_write() fails, mtt.order is
> left set but with an invalid offset, so during dereg,
> mlx4_mtt_cleanup() ends up freeing an MTT range that was never
> allocated. Fix this by resetting mtt.order to -1 in that path.
> 
> Fixes: 9376932d0c26 ("IB/mlx4_ib: Add support for user MR re-registration")
> Signed-off-by: Jacob Moroni <jmoroni@google.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029141634.1557240-1-jmoroni@google.com?part=1