Re: [PATCH rdma-rc 1/2] RDMA/ucma: Lock the handler in ucma_write_cm_event()

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Aug 11, 2026 at 01:54:25PM -0300, Jason Gunthorpe wrote:
> On Mon, Jul 27, 2026 at 10:06:12AM +0200, Norbert Szetei wrote:
> > The window is the mutex_lock() itself: the writer sleeps in it while the
> > migration reassigns ctx->file.  The list_add_tail() then runs on file B's
> > event_list holding only file A's mutex:
> > 
> >   list_add corruption. prev->next should be next (ffff888101320f30),
> >     but was ffff88814a08c418. (prev=ffff88814a075c18).
> >   kernel BUG at lib/list_debug.c:32!
> >   Call Trace:
> >    ucma_write_cm_event+0x36e/0x5e0
> > 
> > and file A's mut is left held forever, wedging its next writer in D state.
> > The uevent is also stranded on a list ucma_cleanup_ctx_events() will not
> > walk, so it outlives its context.  /dev/infiniband/rdma_cm is 0666 and no
> > RDMA device is involved, so an unprivileged user reaches all of this.
> > 
> > Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is
> > pinned by the ucma_get_ctx() reference.
> > 
> > Fixes: a3c9d0fcd371 ("RDMA/ucma: Support write an event into a CM")
> > Cc: stable@vger.kernel.org
> > Assisted-by: Claude:claude-opus-5
> > Signed-off-by: Norbert Szetei <norbert@doyensec.com>
> > ---
> >  drivers/infiniband/core/ucma.c | 2 ++
> >  1 file changed, 2 insertions(+)
> 
> There was another one of this mistake too, I'll send a patch
> 
> applied to for-next

Actually this is not quite right either, ctx->uid is also protected by
the handler lock and pedantically should be checked for zero like the
normal event delivery path.

I will squish this in:

@@ -1779,6 +1779,13 @@ static ssize_t ucma_write_cm_event(struct ucma_file *file,
                goto out;
        }
 
+       rdma_lock_handler(ctx->cm_id);
+       if (!ctx->uid) {
+               kfree(uevent);
+               ret = -EINVAL;
+               goto err_unlock;
+       }
+
        uevent->ctx = ctx;
        uevent->resp.uid = ctx->uid;
        uevent->resp.id = ctx->id;
@@ -1787,13 +1794,13 @@ static ssize_t ucma_write_cm_event(struct ucma_file *file,
        memcpy(uevent->resp.param.arg32, &event.param.arg,
               sizeof(event.param.arg));
 
-       rdma_lock_handler(ctx->cm_id);
        mutex_lock(&ctx->file->mut);
        list_add_tail(&uevent->list, &ctx->file->event_list);
        mutex_unlock(&ctx->file->mut);
        wake_up_interruptible(&ctx->file->poll_wait);
-       rdma_unlock_handler(ctx->cm_id);
 
+err_unlock:
+       rdma_unlock_handler(ctx->cm_id);
 out:
        ucma_put_ctx(ctx);
        return ret;

Jason