0001-RDMA-uverbs-method-elm-fix

0001-RDMA-uverbs-method-elm-fix

[潘煜杭]

[-- Attachment #1.1: Type: text/plain, Size: 3944 bytes --]

Hello,

This patch fixes a NULL pointer dereference in the legacy RDMA uverbs
write() path.

The legacy ib_uverbs_write() path dispatches through a
uverbs_api_write_method, but the uverbs_attr_bundle passed to provider code
does not have an ioctl method element. When malformed provider input causes
the common uverbs validation code to emit an error message,
uverbs_get_handler_fn() may dereference the uninitialized
bundle->method_elm pointer.

The issue was reproduced with the vmw_pvrdma driver. The affected path is:

  ib_uverbs_write()
    -> ib_uverbs_create_cq()
    -> create_cq()
    -> pvrdma_create_cq()
    -> ib_copy_validate_udata_in()
    -> _ib_copy_validate_udata_in()
    -> uverbs_get_handler_fn()
    -> bundle->method_elm->handler

The crash results in a kernel NULL pointer dereference and denial of
service. No evidence of privilege escalation or arbitrary code execution
has been observed.

The fix explicitly initializes method_elm to NULL for legacy bundles and
makes uverbs_get_handler_fn() return NULL when no ioctl method element is
present. The legacy dispatcher continues to use its local write method,
while the ioctl path continues to use the registered ioctl handler.

The patch was prepared after the issue was reported and after review by
Jason Gunthorpe, who requested that it be posted for maintainer review.

Testing:

  make -j$(nproc) drivers/infiniband/core/

The patch applies cleanly to the Linux 7.1.5 source tree. The QEMU runtime
reproducer and the corresponding crash logs are available if maintainers
need them.

Regards,

Yuhang Pan
242270054@hdu.edu.cn


======================================================================
Inline patch content
======================================================================

From 90b7a40eddce6c427783f05fb9cd7c61bde4d8c4 Mon Sep 17 00:00:00 2001
From: Yuhang Pan <242270054@hdu.edu.cn>
Date: Fri, 14 Aug 2026 17:27:23 +0800
Subject: [PATCH] RDMA: uverbs: guard legacy bundles without method_elm

The legacy write() path dispatches through a uverbs_api_write_method, but
the uverbs_attr_bundle passed to provider code does not have an ioctl method
element. If malformed provider input causes the common uverbs validation
code to emit an error message, uverbs_get_handler_fn() dereferences the
uninitialized method_elm pointer.

Initialize method_elm explicitly for legacy bundles and make
uverbs_get_handler_fn() return NULL when no ioctl method is present. The
legacy dispatcher continues to use its local write method, while the ioctl
path continues to use the registered ioctl handler.

Signed-off-by: Yuhang Pan <242270054@hdu.edu.cn>
---
 drivers/infiniband/core/ib_core_uverbs.c | 3 +++
 drivers/infiniband/core/uverbs_main.c    | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/infiniband/core/ib_core_uverbs.c b/drivers/infiniband/core/ib_core_uverbs.c
index 8a0e6fa2a..309d6f4b9 100644
--- a/drivers/infiniband/core/ib_core_uverbs.c
+++ b/drivers/infiniband/core/ib_core_uverbs.c
@@ -425,6 +425,9 @@ uverbs_api_ioctl_handler_fn uverbs_get_handler_fn(struct ib_udata *udata)
 
     lockdep_assert_held(&bundle->ufile->device->disassociate_srcu);
 
+    if (!bundle->method_elm)
+        return NULL;
+
     return srcu_dereference(bundle->method_elm->handler,
                 &bundle->ufile->device->disassociate_srcu);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index f5837da47..8704a39f0 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -615,6 +615,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
     bundle.ufile = file;
     bundle.context = NULL; /* only valid if bundle has uobject */
     bundle.uobject = NULL;
+    bundle.method_elm = NULL;
     if (!method_elm->is_ex) {
         size_t in_len = hdr.in_words * 4 - sizeof(hdr);
         size_t out_len = hdr.out_words * 4;
-- 
2.34.1


[-- Attachment #1.2: Type: text/html, Size: 4767 bytes --]

[-- Attachment #2: 0001-RDMA-uverbs-method-elm-fix.patch --]
[-- Type: text/x-patch, Size: 2118 bytes --]

From 90b7a40eddce6c427783f05fb9cd7c61bde4d8c4 Mon Sep 17 00:00:00 2001
From: Yuhang Pan <242270054@hdu.edu.cn>
Date: Fri, 14 Aug 2026 17:27:23 +0800
Subject: [PATCH] RDMA: uverbs: guard legacy bundles without method_elm

The legacy write() path dispatches through a uverbs_api_write_method, but the uverbs_attr_bundle passed to provider code does not have an ioctl method element. If malformed provider input causes the common uverbs validation code to emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer.

Initialize method_elm explicitly for legacy bundles and make uverbs_get_handler_fn() return NULL when no ioctl method is present. The legacy dispatcher continues to use its local write method, while the ioctl path continues to use the registered ioctl handler.

Signed-off-by: Yuhang Pan <242270054@hdu.edu.cn>
---
 drivers/infiniband/core/ib_core_uverbs.c | 3 +++
 drivers/infiniband/core/uverbs_main.c    | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/infiniband/core/ib_core_uverbs.c b/drivers/infiniband/core/ib_core_uverbs.c
index 8a0e6fa2a..309d6f4b9 100644
--- a/drivers/infiniband/core/ib_core_uverbs.c
+++ b/drivers/infiniband/core/ib_core_uverbs.c
@@ -425,6 +425,9 @@ uverbs_api_ioctl_handler_fn uverbs_get_handler_fn(struct ib_udata *udata)
 
 	lockdep_assert_held(&bundle->ufile->device->disassociate_srcu);
 
+	if (!bundle->method_elm)
+		return NULL;
+
 	return srcu_dereference(bundle->method_elm->handler,
 				&bundle->ufile->device->disassociate_srcu);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index f5837da47..8704a39f0 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -615,6 +615,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
 	bundle.ufile = file;
 	bundle.context = NULL; /* only valid if bundle has uobject */
 	bundle.uobject = NULL;
+	bundle.method_elm = NULL;
 	if (!method_elm->is_ex) {
 		size_t in_len = hdr.in_words * 4 - sizeof(hdr);
 		size_t out_len = hdr.out_words * 4;
-- 
2.34.1

Re: 0001-RDMA-uverbs-method-elm-fix

[Jason Gunthorpe]

On Tue, Aug 18, 2026 at 03:06:36PM +0800, 潘煜杭 wrote:
>    Hello,
>    This patch fixes a NULL pointer dereference in the legacy RDMA uverbs
>    write() path.
>    The legacy ib_uverbs_write() path dispatches through a
>    uverbs_api_write_method, but the uverbs_attr_bundle passed to provider
>    code
>    does not have an ioctl method element. When malformed provider input
>    causes
>    the common uverbs validation code to emit an error message,
>    uverbs_get_handler_fn() may dereference the uninitialized
>    bundle->method_elm pointer.

I fixed up all the issues with this email and applied the patch.

If you intend to submit more kernel patches please learn the process,
there are files in Documentation/ explaining it

Thanks,
Jason