[PATCH] RDMA/mthca: Check for null udata during reg_user_mr

[PATCH] RDMA/mthca: Check for null udata during reg_user_mr

[Jacob Moroni]

The mthca driver was unconditionally checking udata->inlen,
but udata could be null if the user intentionally triggers
the UVERBS_METHOD_REG_MR ioctl. Prevent the potential null
deref by adding a check.

Signed-off-by: Jacob Moroni <jmoroni@google.com>
---
 drivers/infiniband/hw/mthca/mthca_provider.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index f90f67afc8f..6005ed40665 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -863,6 +863,9 @@ static struct ib_mr *mthca_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	if (dmah)
 		return ERR_PTR(-EOPNOTSUPP);
 
+	if (!udata)
+		return ERR_PTR(-EINVAL);
+
 	if (udata->inlen < sizeof ucmd) {
 		if (!context->reg_mr_warned) {
 			mthca_warn(dev, "Process '%s' did not pass in MR attrs.\n",
-- 
2.55.0.rc0.799.gd6f94ed593-goog

Re: [PATCH] RDMA/mthca: Check for null udata during reg_user_mr

[Jason Gunthorpe]

On Tue, Jun 30, 2026 at 03:55:05PM +0000, Jacob Moroni wrote:
> The mthca driver was unconditionally checking udata->inlen,
> but udata could be null if the user intentionally triggers
> the UVERBS_METHOD_REG_MR ioctl. Prevent the potential null
> deref by adding a check.

???

reg_user_mr should never have a null udata how does this happen?

Jason

Re: [PATCH] RDMA/mthca: Check for null udata during reg_user_mr

[Jacob Moroni]

For irdma at least, I was able to trigger it with a one-off test binary
that directly invokes the UVERBS_METHOD_REG_MR ioctl.

The handler in the kernel then calls ops.reg_user_mr with null as
the last argument.

drivers/infiniband/core/uverbs_std_types_mr.c#L366

Thanks,
Jake

Re: [PATCH] RDMA/mthca: Check for null udata during reg_user_mr

[Jason Gunthorpe]

On Tue, Jun 30, 2026 at 12:04:45PM -0400, Jacob Moroni wrote:
> For irdma at least, I was able to trigger it with a one-off test binary
> that directly invokes the UVERBS_METHOD_REG_MR ioctl.
> 
> The handler in the kernel then calls ops.reg_user_mr with null as
> the last argument.
> 
> drivers/infiniband/core/uverbs_std_types_mr.c#L366

I think that is a bug, would need to research why it turned out like
that.

"user mr" should always have an attrs.

Jason