Re: [PATCH 5.10 094/147] RDMA/rxe: Fix double free in rxe_srq_from_init

Ben Hutchings
2026-03-23T12:37:59Z

[-- Attachment #1: Type: text/plain, Size: 1637 bytes --]

On Sat, 2026-02-28 at 13:16 -0500, Sasha Levin wrote:
> From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
>
> [ Upstream commit 0beefd0e15d962f497aad750b2d5e9c3570b66d1 ]
>
> In rxe_srq_from_init(), the queue pointer 'q' is assigned to
> 'srq->rq.queue' before copying the SRQ number to user space.
> If copy_to_user() fails, the function calls rxe_queue_cleanup()
> to free the queue, but leaves the now-invalid pointer in
> 'srq->rq.queue'.
[...]
> Fix this by moving 'srq->rq.queue = q' after copy_to_user.

But this backport to 5.10 only added an assignment to srq->rq.queue and
did not remove the existing assignment (on line 101), so the bug is not
fixed here.

Ben.

> Fixes: aae0484e15f0 ("IB/rxe: avoid srq memory leak")
> Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
> Link: https://patch.msgid.link/20260112015412.29458-1-jiashengjiangcool@gmail.com
> Reviewed-by: Zhu Yanjun <yanjun.Zhu@linux.dev>
> Signed-off-by: Leon Romanovsky <leon@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/infiniband/sw/rxe/rxe_srq.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
> index 41b0d1e11bafd..9d9baca269499 100644
> --- a/drivers/infiniband/sw/rxe/rxe_srq.c
> +++ b/drivers/infiniband/sw/rxe/rxe_srq.c
> @@ -116,6 +116,9 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
> }
> }
>
> + srq->rq.queue = q;
> + init->attr.max_wr = srq->rq.max_wr;
> +
> return 0;
> }
>

--
Ben Hutchings
73.46% of all statistics are made up.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]