Re: [PATCH] RDMA/rtrs: Register client event handler after capability check

[sashiko-bot@kernel.org]

> rtrs_clt_ib_dev_init() registers dev->event_handler before checking
> IB_DEVICE_MEM_MGT_EXTENSIONS. If the device does not provide that
> capability, init returns -ENOTSUPP and rtrs_ib_dev_find_or_add() frees
> dev through out_free_pd without calling the deinit callback. The embedded
> event handler therefore remains on the IB device's list after its storage
> has been freed.
> 
> A later IB event walks the dangling list entry and accesses freed memory.
> The issue was found by static analysis. A focused out-of-tree test module
> on an x86_64 QEMU/KASAN kernel temporarily cleared only
> IB_DEVICE_MEM_MGT_EXTENSIONS on a SIW device, exercised the real
> rtrs_clt_ib_dev_init() callback through rtrs_ib_dev_find_or_add(), restored
> the capabilities, and dispatched IB_EVENT_DEVICE_FATAL. KASAN reported
> an 8-byte slab-use-after-free read in ib_dispatch_event_clients(), with
> both the allocation and free originating in rtrs_ib_dev_find_or_add().
> 
> Move the capability check before event handler registration. The check is
> a prerequisite for successful client initialization. Registration cannot
> fail and init returns success immediately afterwards, so every installed
> handler is now owned by a successfully initialized device and is removed
> by the existing deinit callback.
> 
> Fixes: 667db86bcbe8 ("RDMA/rtrs: Register ib event handler")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179378222423.73361.3247716499619173751@jaeyeong.cc?part=1