Re: [LTP] [PATCH 2/2] device-drivers/rdma: Add ucma_uaf01 test

[Leon Romanovsky <leon@kernel.org>]

On Tue, Apr 14, 2026 at 09:30:10AM +0200, Petr Vorel wrote:
> Hi Leon, all,
> 
> > On Tue, Apr 07, 2026 at 03:24:26PM +0200, Petr Vorel wrote:
> > > Hi Andrea,
> 
> > > it's been long time since this use-after-free was fixed, but IMHO still useful
> > > to have a test (it's also kind of smoke test for rdma_cm).
> > > Anyway, LGTM, but it'd be nice to reproduce the bug.
> 
> > > Reviewed-by: Petr Vorel <pvorel@suse.cz>
> 
> > > > Test for use-after-free in RDMA UCMA triggered by racing CREATE_ID,
> > > > BIND_IP, and LISTEN operations. Three threads concurrently issue
> > > > these commands to /dev/infiniband/rdma_cm and the test checks for
> > > > kernel taint (KASAN use-after-free detection).
> 
> > > > The bug was fixed by kernel commit 5fe23f262e05
> > > > ("ucma: fix a use-after-free in ucma_resolve_ip()").
> 
> > > > Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> > > > ---
> > > >  runtest/kernel_misc                               |   1 +
> > > >  testcases/kernel/device-drivers/Makefile          |   1 +
> > > >  testcases/kernel/device-drivers/rdma/.gitignore   |   1 +
> > > >  testcases/kernel/device-drivers/rdma/Makefile     |   7 +
> > > >  testcases/kernel/device-drivers/rdma/ucma_uaf01.c | 208 ++++++++++++++++++++++
> > > >  5 files changed, 218 insertions(+)
> 
> > <...>
> 
> > > > +static struct tst_test test = {
> > > > +	.test_all = run,
> > > > +	.setup = setup,
> > > > +	.cleanup = cleanup,
> > > > +	.runtime = 300,
> > > > +	.needs_root = 1,
> > > > +	.taint_check = TST_TAINT_W | TST_TAINT_D,
> > > > +	.needs_kconfigs = (const char *[]) {
> > > > +		"CONFIG_INFINIBAND",
> > > > +		"CONFIG_INFINIBAND_USER_ACCESS",
> 
> > I’m not familiar with the LTP tests, but I wanted to point out that these
> > config options are insufficient. You need an actual or virtual RDMA device
> > connected to rdma-cm for the tests to work correctly.
> 
> Leon, thanks for looking into it. FYI these are just config options to skip
> kernels without required kernel modules. 
> 
> So using /dev/infiniband/rdma_cm (via RDMA_CM_DEV) is not enough, we need
> another device?

Yes, `rdma-cm` provides an interface for address resolution on
IB/iWARP/RoCE networks without requiring knowledge of the underlying
fabric details.

When an IB device is registered, RDMA/core invokes `cm_add_one()`, which
attaches `rdma-cm` to that device.
https://elixir.bootlin.com/linux/v7.0/source/drivers/infiniband/core/cm.c#L4335

Thanks

> 
> Kind regards,
> Petr