[PATCH] RDMA/core: Fix member use-after-free in process_group_error()

[PATCH] RDMA/core: Fix member use-after-free in process_group_error()

[Wentao Liang]

If the callback on the error path returns non-zero after a concurrent
ib_sa_free_multicast() already dropped the initial member reference,
dropping our temporary reference completes the waiter, which then frees
the member before ib_sa_free_multicast() dereferences it again.

Only free the multicast member when our reference decrement was not
the last one; otherwise the concurrent free is already in flight.

Fixes: faec2f7b96b5 ("IB/sa: Track multicast join/leave requests")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/infiniband/core/multicast.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index bea7df3dd8f3..aa6fdac5fcde 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -409,8 +409,9 @@ static void process_group_error(struct mcast_group *group)
 
 		ret = member->multicast.callback(-ENETRESET,
 						 &member->multicast);
-		deref_member(member);
-		if (ret)
+		if (refcount_dec_and_test(&member->refcount))
+			complete(&member->comp);
+		else if (ret)
 			ib_sa_free_multicast(&member->multicast);
 		spin_lock_irq(&group->lock);
 	}
-- 
2.34.1

Re: [PATCH] RDMA/core: Fix member use-after-free in process_group_error()

[sashiko-bot]

> If the callback on the error path returns non-zero after a concurrent
> ib_sa_free_multicast() already dropped the initial member reference,
> dropping our temporary reference completes the waiter, which then frees
> the member before ib_sa_free_multicast() dereferences it again.
> 
> Only free the multicast member when our reference decrement was not
> the last one; otherwise the concurrent free is already in flight.
> 
> Fixes: faec2f7b96b5 ("IB/sa: Track multicast join/leave requests")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916184555.2093238-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] RDMA/core: Fix member use-after-free in process_group_error()

[Leon Romanovsky]

On Wed, Sep 16, 2026 at 06:45:55PM +0000, Wentao Liang wrote:
> If the callback on the error path returns non-zero after a concurrent
> ib_sa_free_multicast() already dropped the initial member reference,
> dropping our temporary reference completes the waiter, which then frees
> the member before ib_sa_free_multicast() dereferences it again.
> 
> Only free the multicast member when our reference decrement was not
> the last one; otherwise the concurrent free is already in flight.

I'm not sure that last sentence is correct. Can you prove it?
Because we have the following code:
  662 void ib_sa_free_multicast(struct ib_sa_multicast *multicast)
  663 {
  ...
  685
  686         deref_member(member);
  687         wait_for_completion(&member->comp);
  ...
  691 EXPORT_SYMBOL(ib_sa_free_multicast);

Thanks

> 
> Fixes: faec2f7b96b5 ("IB/sa: Track multicast join/leave requests")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/infiniband/core/multicast.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
> index bea7df3dd8f3..aa6fdac5fcde 100644
> --- a/drivers/infiniband/core/multicast.c
> +++ b/drivers/infiniband/core/multicast.c
> @@ -409,8 +409,9 @@ static void process_group_error(struct mcast_group *group)
>  
>  		ret = member->multicast.callback(-ENETRESET,
>  						 &member->multicast);
> -		deref_member(member);
> -		if (ret)
> +		if (refcount_dec_and_test(&member->refcount))
> +			complete(&member->comp);
> +		else if (ret)
>  			ib_sa_free_multicast(&member->multicast);
>  		spin_lock_irq(&group->lock);
>  	}
> -- 
> 2.34.1
>