[PATCH] RDMA/iwpm: fix kref bypass in iwpm_register_pid() error path

[PATCH] RDMA/iwpm: fix kref bypass in iwpm_register_pid() error path

[Wentao Liang]

iwpm_get_nlmsg_request() returns a request with kref_init() +
kref_get() (refcount=2, one for the caller and one for the
iwpm_nlmsg_req_list). On the error path, iwpm_register_pid()
calls iwpm_free_nlmsg_request() directly instead of using
kref_put(), bypassing the kref mechanism and freeing the object
while the refcount is still non-zero.

Replace the direct iwpm_free_nlmsg_request() call with
kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request).

Cc: stable@vger.kernel.org
Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/infiniband/core/iwpm_msg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 4625abd29ac0..672b0c33a6de 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -122,7 +122,7 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
 	pr_info("%s: %s (client = %u)\n", __func__, err_str, nl_client);
 	dev_kfree_skb(skb);
 	if (nlmsg_request)
-		iwpm_free_nlmsg_request(&nlmsg_request->kref);
+		kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
 	return ret;
 }
 
-- 
2.34.1

Re: [PATCH] RDMA/iwpm: fix kref bypass in iwpm_register_pid() error path

[Jason Gunthorpe]

On Mon, Jun 08, 2026 at 10:30:01AM +0000, Wentao Liang wrote:
> iwpm_get_nlmsg_request() returns a request with kref_init() +
> kref_get() (refcount=2, one for the caller and one for the
> iwpm_nlmsg_req_list). On the error path, iwpm_register_pid()
> calls iwpm_free_nlmsg_request() directly instead of using
> kref_put(), bypassing the kref mechanism and freeing the object
> while the refcount is still non-zero.
> 
> Replace the direct iwpm_free_nlmsg_request() call with
> kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request).
> 
> Cc: stable@vger.kernel.org
> Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/infiniband/core/iwpm_msg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
> index 4625abd29ac0..672b0c33a6de 100644
> --- a/drivers/infiniband/core/iwpm_msg.c
> +++ b/drivers/infiniband/core/iwpm_msg.c
> @@ -122,7 +122,7 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
>  	pr_info("%s: %s (client = %u)\n", __func__, err_str, nl_client);
>  	dev_kfree_skb(skb);
>  	if (nlmsg_request)
> -		iwpm_free_nlmsg_request(&nlmsg_request->kref);
> +		kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
>  	return ret;

Sashiko doesn't like any of these changes.

https://patchwork.kernel.org/project/linux-rdma/patch/20260608103001.142648-1-vulab@iscas.ac.cn/

Does this change introduce a stack memory corruption risk?

Because iwpm_get_nlmsg_request() initializes the request with a refcount of
2, this kref_put() only decrements it to 1. The object is not freed or
removed from the global iwpm_nlmsg_req_list.

Jason