[PATCH] RDMA/ucma: Fix use-after-free in ucma_create_uevent

[PATCH] RDMA/ucma: Fix use-after-free in ucma_create_uevent

[shaikh.kamal]

ucma_create_uevent() dereferences event->param.ud.private_data
as a struct ucma_multicast for multicast events. However,
this pointer may refer to memory that has already been freed,
leading to a use-after-free.

Fix this by avoiding dereferencing private_data for multicast
events and instead using ctx for uid and id, which has a
well-defined lifetime.

Tested by running the reproducer under KASAN with slub_debug
enabled for several hours with no crashes observed.

Reported-by: syzbot+a6ffe86390c8a6afc818@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a6ffe86390c8a6afc818
Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")

Signed-off-by: shaikh.kamal <shaikhkamal2012@gmail.com>
---
 drivers/infiniband/core/ucma.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 6e700b974033..8eef10352af7 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -270,10 +270,12 @@ static struct ucma_event *ucma_create_uevent(struct ucma_context *ctx,
 	switch (event->event) {
 	case RDMA_CM_EVENT_MULTICAST_JOIN:
 	case RDMA_CM_EVENT_MULTICAST_ERROR:
-		uevent->mc = (struct ucma_multicast *)
-			     event->param.ud.private_data;
-		uevent->resp.uid = uevent->mc->uid;
-		uevent->resp.id = uevent->mc->id;
+		/*
+		 * event->param.ud.private_data may point to a ucma_multicast
+		 * that has already been freed, so use ctx instead.
+		 */
+		uevent->resp.uid = ctx->uid;
+		uevent->resp.id = ctx->id;
 		break;
 	default:
 		uevent->resp.uid = ctx->uid;
-- 
2.43.0

Re: [PATCH] RDMA/ucma: Fix use-after-free in ucma_create_uevent

[Leon Romanovsky]

On Sun, May 03, 2026 at 04:21:25PM +0530, shaikh.kamal wrote:
> ucma_create_uevent() dereferences event->param.ud.private_data
> as a struct ucma_multicast for multicast events. However,
> this pointer may refer to memory that has already been freed,
> leading to a use-after-free.
> 
> Fix this by avoiding dereferencing private_data for multicast
> events and instead using ctx for uid and id, which has a
> well-defined lifetime.
> 
> Tested by running the reproducer under KASAN with slub_debug
> enabled for several hours with no crashes observed.
> 
> Reported-by: syzbot+a6ffe86390c8a6afc818@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a6ffe86390c8a6afc818
> Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
> 
> Signed-off-by: shaikh.kamal <shaikhkamal2012@gmail.com>
> ---
>  drivers/infiniband/core/ucma.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
> index 6e700b974033..8eef10352af7 100644
> --- a/drivers/infiniband/core/ucma.c
> +++ b/drivers/infiniband/core/ucma.c
> @@ -270,10 +270,12 @@ static struct ucma_event *ucma_create_uevent(struct ucma_context *ctx,
>  	switch (event->event) {
>  	case RDMA_CM_EVENT_MULTICAST_JOIN:
>  	case RDMA_CM_EVENT_MULTICAST_ERROR:
> -		uevent->mc = (struct ucma_multicast *)
> -			     event->param.ud.private_data;
> -		uevent->resp.uid = uevent->mc->uid;
> -		uevent->resp.id = uevent->mc->id;
> +		/*
> +		 * event->param.ud.private_data may point to a ucma_multicast
> +		 * that has already been freed, so use ctx instead.
> +		 */
> +		uevent->resp.uid = ctx->uid;
> +		uevent->resp.id = ctx->id;

I believe your analysis is correct, but the implementation is not.  
Are you certain that `ctx->uid == uevent->mc->uid` and `ctx->id == uevent->mc->id`?

Thanks

>  		break;
>  	default:
>  		uevent->resp.uid = ctx->uid;
> -- 
> 2.43.0
> 
>