Re: [LTP] [PATCH 2/2] device-drivers/rdma: Add ucma_uaf01 test

Leon Romanovsky
2026-04-12T14:14:45Z

On Tue, Apr 07, 2026 at 03:24:26PM +0200, Petr Vorel wrote:
> Hi Andrea,
>
> it's been long time since this use-after-free was fixed, but IMHO still useful
> to have a test (it's also kind of smoke test for rdma_cm).
> Anyway, LGTM, but it'd be nice to reproduce the bug.
>
> Reviewed-by: Petr Vorel <pvorel@suse.cz>
>
> > Test for use-after-free in RDMA UCMA triggered by racing CREATE_ID,
> > BIND_IP, and LISTEN operations. Three threads concurrently issue
> > these commands to /dev/infiniband/rdma_cm and the test checks for
> > kernel taint (KASAN use-after-free detection).
>
> > The bug was fixed by kernel commit 5fe23f262e05
> > ("ucma: fix a use-after-free in ucma_resolve_ip()").
>
> > Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> > ---
> > runtest/kernel_misc | 1 +
> > testcases/kernel/device-drivers/Makefile | 1 +
> > testcases/kernel/device-drivers/rdma/.gitignore | 1 +
> > testcases/kernel/device-drivers/rdma/Makefile | 7 +
> > testcases/kernel/device-drivers/rdma/ucma_uaf01.c | 208 ++++++++++++++++++++++
> > 5 files changed, 218 insertions(+)

<...>

> > +static struct tst_test test = {
> > + .test_all = run,
> > + .setup = setup,
> > + .cleanup = cleanup,
> > + .runtime = 300,
> > + .needs_root = 1,
> > + .taint_check = TST_TAINT_W | TST_TAINT_D,
> > + .needs_kconfigs = (const char *[]) {
> > + "CONFIG_INFINIBAND",
> > + "CONFIG_INFINIBAND_USER_ACCESS",

I’m not familiar with the LTP tests, but I wanted to point out that these
config options are insufficient. You need an actual or virtual RDMA device
connected to rdma-cm for the tests to work correctly.

Thanks