[PATCH] RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

[PATCH] RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

[Jeffin Philip]

iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()
making it accessible to global list where another CPU can kref_get()
on nlmsg_request causing a refcount "addition on 0" bug. Fix this
by initializing kref _before_ list_add_tail() so refcount for
nlmsg_request can be incremented/decremented normally.

Reported-by: syzbot+bd317784d628820741b5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bd317784d628820741b5
Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
---
 drivers/infiniband/core/iwpm_util.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index 990cf928b32a..5d07c5756987 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -313,13 +313,13 @@ struct iwpm_nlmsg_request *iwpm_get_nlmsg_request(__u32 nlmsg_seq,
 	nlmsg_request = kzalloc_obj(struct iwpm_nlmsg_request, gfp);
 	if (!nlmsg_request)
 		return NULL;
+	kref_init(&nlmsg_request->kref);
+	kref_get(&nlmsg_request->kref);
 
 	spin_lock_irqsave(&iwpm_nlmsg_req_lock, flags);
 	list_add_tail(&nlmsg_request->inprocess_list, &iwpm_nlmsg_req_list);
 	spin_unlock_irqrestore(&iwpm_nlmsg_req_lock, flags);
 
-	kref_init(&nlmsg_request->kref);
-	kref_get(&nlmsg_request->kref);
 	nlmsg_request->nlmsg_seq = nlmsg_seq;
 	nlmsg_request->nl_client = nl_client;
 	nlmsg_request->request_done = 0;
-- 
2.55.0

Re: [PATCH] RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

[Leon Romanovsky]

On Wed, Sep 02, 2026 at 02:22:13PM +0530, Jeffin Philip wrote:
> iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()
> making it accessible to global list where another CPU can kref_get()
> on nlmsg_request causing a refcount "addition on 0" bug. Fix this
> by initializing kref _before_ list_add_tail() so refcount for
> nlmsg_request can be incremented/decremented normally.
> 
> Reported-by: syzbot+bd317784d628820741b5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=bd317784d628820741b5
> Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
> ---
>  drivers/infiniband/core/iwpm_util.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
> index 990cf928b32a..5d07c5756987 100644
> --- a/drivers/infiniband/core/iwpm_util.c
> +++ b/drivers/infiniband/core/iwpm_util.c
> @@ -313,13 +313,13 @@ struct iwpm_nlmsg_request *iwpm_get_nlmsg_request(__u32 nlmsg_seq,
>  	nlmsg_request = kzalloc_obj(struct iwpm_nlmsg_request, gfp);
>  	if (!nlmsg_request)
>  		return NULL;
> +	kref_init(&nlmsg_request->kref);
> +	kref_get(&nlmsg_request->kref);
>  
>  	spin_lock_irqsave(&iwpm_nlmsg_req_lock, flags);
>  	list_add_tail(&nlmsg_request->inprocess_list, &iwpm_nlmsg_req_list);
>  	spin_unlock_irqrestore(&iwpm_nlmsg_req_lock, flags);

These three lines need to be the last in the function, i.e. all fields must
be initialized, not just the refcount.

Thanks

>  
> -	kref_init(&nlmsg_request->kref);
> -	kref_get(&nlmsg_request->kref);
>  	nlmsg_request->nlmsg_seq = nlmsg_seq;
>  	nlmsg_request->nl_client = nl_client;
>  	nlmsg_request->request_done = 0;
> -- 
> 2.55.0
> 

[PATCH v2] RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

[Jeffin Philip]

iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()
making it accessible to global list where another CPU can kref_get()
on nlmsg_request causing a refcount "addition on 0" bug. Fix this
by initializing kref _before_ list_add_tail() so refcount for
nlmsg_request can be incremented/decremented normally. In addition,
also initialize every field before list_add_tail().

Reported-by: syzbot+bd317784d628820741b5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bd317784d628820741b5
Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
---
Changelog:
   Changes in v2:
      Add list_add_tail() last after initializing every field as per Leon Romanovsky's
   suggestion.
---
 drivers/infiniband/core/iwpm_util.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index 5d07c5756987..51af8c1c49f9 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -313,19 +313,20 @@ struct iwpm_nlmsg_request *iwpm_get_nlmsg_request(__u32 nlmsg_seq,
 	nlmsg_request = kzalloc_obj(struct iwpm_nlmsg_request, gfp);
 	if (!nlmsg_request)
 		return NULL;
+
 	kref_init(&nlmsg_request->kref);
 	kref_get(&nlmsg_request->kref);
-
-	spin_lock_irqsave(&iwpm_nlmsg_req_lock, flags);
-	list_add_tail(&nlmsg_request->inprocess_list, &iwpm_nlmsg_req_list);
-	spin_unlock_irqrestore(&iwpm_nlmsg_req_lock, flags);
-
 	nlmsg_request->nlmsg_seq = nlmsg_seq;
 	nlmsg_request->nl_client = nl_client;
 	nlmsg_request->request_done = 0;
 	nlmsg_request->err_code = 0;
 	sema_init(&nlmsg_request->sem, 1);
 	down(&nlmsg_request->sem);
+
+	spin_lock_irqsave(&iwpm_nlmsg_req_lock, flags);
+	list_add_tail(&nlmsg_request->inprocess_list, &iwpm_nlmsg_req_list);
+	spin_unlock_irqrestore(&iwpm_nlmsg_req_lock, flags);
+
 	return nlmsg_request;
 }
 
-- 
2.55.0

Re: [PATCH v2] RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

[Leon Romanovsky]

On Thu, Sep 03, 2026 at 03:47:42PM +0530, Jeffin Philip wrote:
> iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()
> making it accessible to global list where another CPU can kref_get()
> on nlmsg_request causing a refcount "addition on 0" bug. Fix this
> by initializing kref _before_ list_add_tail() so refcount for
> nlmsg_request can be incremented/decremented normally. In addition,
> also initialize every field before list_add_tail().
> 
> Reported-by: syzbot+bd317784d628820741b5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=bd317784d628820741b5
> Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
> ---
> Changelog:
>    Changes in v2:
>       Add list_add_tail() last after initializing every field as per Leon Romanovsky's
>    suggestion.
> ---
>  drivers/infiniband/core/iwpm_util.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)

The patch doesn't apply and please send it as standalone patch and not
as Reply-to.

Thanks