[PATCH RFC] RDMA/irdma: check vport device allocation

[PATCH RFC] RDMA/irdma: check vport device allocation

[Slavin Liu]

An existing RDMA function does not guarantee allocation of the new
vport device. Return -ENOMEM before initializing a NULL iwdev.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 2ad49ae7330b ("RDMA/irdma: Introduce GEN3 vPort driver support")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 drivers/infiniband/hw/irdma/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/irdma/main.c b/drivers/infiniband/hw/irdma/main.c
index 95957d52883d..106915b51e7c 100644
--- a/drivers/infiniband/hw/irdma/main.c
+++ b/drivers/infiniband/hw/irdma/main.c
@@ -80,6 +80,8 @@ static int ig3rdma_vport_probe(struct auxiliary_device *aux_dev,
 		return -ENOMEM;
 	}
 	iwdev = ib_alloc_device(irdma_device, ibdev);
+	if (!iwdev)
+		return -ENOMEM;
 	/* Fill iwdev info */
 	iwdev->is_vport = true;
 	iwdev->rf = rf;

Re: [PATCH RFC] RDMA/irdma: check vport device allocation

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double-free and Use-After-Free in the probe error paths when irdma_ib_register_device() fails, due to redundant irdma_rt_deinit_hw() and irdma_ctrl_deinit_hw() calls.
--

commit 0981212030a2affcec23860d2a7ba06344c067f0
Author: Slavin Liu <bolin.liu@seu.edu.cn>

RDMA/irdma: check vport device allocation

This commit adds a missing NULL pointer check after allocating iwdev in
ig3rdma_vport_probe(). It returns -ENOMEM to prevent initializing the
structure if the allocation fails.

> diff --git a/drivers/infiniband/hw/irdma/main.c b/drivers/infiniband/hw/irdma/main.c
> index 95957d52883dd..106915b51e7cb 100644
> --- a/drivers/infiniband/hw/irdma/main.c
> +++ b/drivers/infiniband/hw/irdma/main.c
> @@ -80,6 +80,8 @@ static int ig3rdma_vport_probe(struct auxiliary_device *aux_dev,
>  		return -ENOMEM;
>  	}
>  	iwdev = ib_alloc_device(irdma_device, ibdev);
> +	if (!iwdev)
> +		return -ENOMEM;
>  	/* Fill iwdev info */
>  	iwdev->is_vport = true;
>  	iwdev->rf = rf;

[Severity: High]
This is a pre-existing issue, but does the error handling later in
ig3rdma_vport_probe() trigger a double-free if irdma_ib_register_device()
fails?

If irdma_ib_register_device() fails after setting the .dealloc_driver
callback, the error unrolling logic manually tears down resources and then
calls ib_dealloc_device():

drivers/infiniband/hw/irdma/main.c:ig3rdma_vport_probe() {
    ...
err_ibreg:
	irdma_rt_deinit_hw(iwdev);
err_rt_init:
	ib_dealloc_device(&iwdev->ibdev);

	return err;
}

Because ib_dealloc_device() automatically invokes the registered
.dealloc_driver callback, it calls irdma_ib_dealloc_device() which
redundantly repeats the teardown:

drivers/infiniband/hw/irdma/verbs.c:irdma_ib_dealloc_device() {
	struct irdma_device *iwdev = to_iwdev(ibdev);

	irdma_rt_deinit_hw(iwdev);
    ...
}

Would calling irdma_rt_deinit_hw() a second time cause a double kfree() on
iwdev->vsi.pestat and a double destroy_workqueue() on iwdev->cleanup_wq?

drivers/infiniband/hw/irdma/hw.c:irdma_rt_deinit_hw() {
    ...
	if (iwdev->vsi.pestat) {
		irdma_vsi_stats_free(&iwdev->vsi);
		kfree(iwdev->vsi.pestat);
	}
	if (iwdev->cleanup_wq)
		destroy_workqueue(iwdev->cleanup_wq);
    ...
}

Additionally, does this same pattern cause a use-after-free in non-vport
drivers?

drivers/infiniband/hw/irdma/i40iw_if.c:i40iw_open() {
    ...
err_ctrl_init:
	kfree(iwdev->rf);
	ib_dealloc_device(&iwdev->ibdev);
    ...
}

Since the unexpected dealloc_driver callback dereferences iwdev->rf,
wouldn't this guarantee a use-after-free on iwdev->rf?

drivers/infiniband/hw/irdma/verbs.c:irdma_ib_dealloc_device() {
    ...
	if (!iwdev->is_vport) {
		irdma_ctrl_deinit_hw(iwdev->rf);
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911060909.94219-1-bolin.liu@seu.edu.cn?part=1