[PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table

[PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table

[Deepanshu Kartikey]

Commit 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
converted alloc_gid_table() to use kzalloc_flex(), which allocates
the ib_gid_table struct and its trailing data_vec flex array member
in a single contiguous slab block.

However, release_gid_table() was not updated accordingly and still
calls kfree(table->data_vec), passing a pointer that points 216 bytes
into the middle of the slab object rather than its head. This is an
invalid free which KASAN catches as:

  BUG: KASAN: invalid-free in release_gid_table+0x384/0x470

Since data_vec is now a flex array member of ib_gid_table, it is
freed implicitly when kfree(table) is called. Remove the redundant
and invalid kfree(table->data_vec).

Fixes: 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
Reported-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4334f9a250019c1b79b4
Tested-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/infiniband/core/cache.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 896486fa6185..647a547e2d7f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -801,7 +801,6 @@ static void release_gid_table(struct ib_device *device,
 	}
 
 	mutex_destroy(&table->lock);
-	kfree(table->data_vec);
 	kfree(table);
 }
 
-- 
2.43.0

Re: [PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table

[Deepanshu Kartikey]

On Wed, Apr 1, 2026 at 6:58 AM Deepanshu Kartikey <kartikey406@gmail.com> wrote:
>
> Commit 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
> converted alloc_gid_table() to use kzalloc_flex(), which allocates
> the ib_gid_table struct and its trailing data_vec flex array member
> in a single contiguous slab block.
>
> However, release_gid_table() was not updated accordingly and still
> calls kfree(table->data_vec), passing a pointer that points 216 bytes
> into the middle of the slab object rather than its head. This is an
> invalid free which KASAN catches as:
>
>   BUG: KASAN: invalid-free in release_gid_table+0x384/0x470
>
> Since data_vec is now a flex array member of ib_gid_table, it is
> freed implicitly when kfree(table) is called. Remove the redundant
> and invalid kfree(table->data_vec).
>
> Fixes: 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
> Reported-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=4334f9a250019c1b79b4
> Tested-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/infiniband/core/cache.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
> index 896486fa6185..647a547e2d7f 100644
> --- a/drivers/infiniband/core/cache.c
> +++ b/drivers/infiniband/core/cache.c
> @@ -801,7 +801,6 @@ static void release_gid_table(struct ib_device *device,
>         }
>
>         mutex_destroy(&table->lock);
> -       kfree(table->data_vec);
>         kfree(table);
>  }
>
> --
> 2.43.0
>

Gentle ping on this patch. Please let me know the status of this patch.

Thanks

Deepanshu Kartikey

Re: [PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table

[Jason Gunthorpe]

On Fri, Apr 10, 2026 at 05:22:54PM +0530, Deepanshu Kartikey wrote:
> > diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
> > index 896486fa6185..647a547e2d7f 100644
> > --- a/drivers/infiniband/core/cache.c
> > +++ b/drivers/infiniband/core/cache.c
> > @@ -801,7 +801,6 @@ static void release_gid_table(struct ib_device *device,
> >         }
> >
> >         mutex_destroy(&table->lock);
> > -       kfree(table->data_vec);
> >         kfree(table);
> >  }
> >
> >
> 
> Gentle ping on this patch. Please let me know the status of this patch.

Oh, I think a different version was picked up

Thanks,
Jason