Re: [PATCH 5.10 094/147] RDMA/rxe: Fix double free in rxe_srq_from_init

Yanjun.Zhu
2026-03-23T18:15:49Z

On 3/23/26 5:37 AM, Ben Hutchings wrote:
> On Sat, 2026-02-28 at 13:16 -0500, Sasha Levin wrote:
>> From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
>>
>> [ Upstream commit 0beefd0e15d962f497aad750b2d5e9c3570b66d1 ]
>>
>> In rxe_srq_from_init(), the queue pointer 'q' is assigned to
>> 'srq->rq.queue' before copying the SRQ number to user space.
>> If copy_to_user() fails, the function calls rxe_queue_cleanup()
>> to free the queue, but leaves the now-invalid pointer in
>> 'srq->rq.queue'.
> [...]
>> Fix this by moving 'srq->rq.queue = q' after copy_to_user.
> But this backport to 5.10 only added an assignment to srq->rq.queue and
> did not remove the existing assignment (on line 101), so the bug is not
> fixed here.
74 int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
75                       struct ib_srq_init_attr *init, struct
ib_udata *udata,
76                       struct rxe_create_srq_resp __user *uresp)
77 {

...

100

101         srq->rq.queue = q;       <----This line still exists.
102
103         err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata,
q->buf,
104                            q->buf_size, &q->ip);
105         if (err) {
106                 vfree(q->buf);
107                 kfree(q);
108                 return err;
109         }
110
111         if (uresp) {
112                 if (copy_to_user(&uresp->srq_num, &srq->srq_num,
113                                  sizeof(uresp->srq_num))) {
114                         rxe_queue_cleanup(q);
115                         return -EFAULT;
116                 }
117         }

..

122         return 0;

123 }

Thanks a lot. I think this problem that ("RDMA/rxe: Fix double free in
rxe_srq_from_init") mentioned still exists.

In Linux 5.10.252, maybe the following can fix this problem.

"
diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c
b/drivers/infiniband/sw/rxe/rxe_srq.c
index 9d9baca26949..65bad1ec170e 100644
--- a/drivers/infiniband/sw/rxe/rxe_srq.c
+++ b/drivers/infiniband/sw/rxe/rxe_srq.c
@@ -98,8 +98,6 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct
rxe_srq *srq,
return -ENOMEM;
}

-       srq->rq.queue = q;
-
err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata, q->buf,
q->buf_size, &q->ip);
if (err) {
"

Thanks. Ben.

Zhu Yanjun

>
> Ben.
>
>> Fixes: aae0484e15f0 ("IB/rxe: avoid srq memory leak")
>> Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
>> Link: https://patch.msgid.link/20260112015412.29458-1-jiashengjiangcool@gmail.com
>> Reviewed-by: Zhu Yanjun <yanjun.Zhu@linux.dev>
>> Signed-off-by: Leon Romanovsky <leon@kernel.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>> drivers/infiniband/sw/rxe/rxe_srq.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
>> index 41b0d1e11bafd..9d9baca269499 100644
>> --- a/drivers/infiniband/sw/rxe/rxe_srq.c
>> +++ b/drivers/infiniband/sw/rxe/rxe_srq.c
>> @@ -116,6 +116,9 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
>> }
>> }
>>
>> + srq->rq.queue = q;
>> + init->attr.max_wr = srq->rq.max_wr;
>> +
>> return 0;
>> }
>>