[PATCH] RDMA/mlx5: Restore mr->pi_mr after temporary stack-local assignment

[PATCH] RDMA/mlx5: Restore mr->pi_mr after temporary stack-local assignment

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

In handle_reg_mr_integrity, when mr->pi_mr is NULL (physical-address
optimization path), the code points mr->pi_mr at a stack-local pa_pi_mr
so set_pi_umr_wr can read it during this call. The pointer is never
restored, so after the function returns mr->pi_mr dangles at a freed stack
frame. A second IB_WR_REG_MR_INTEGRITY posted on the same MR without
remapping reads the stale pointer and dereferences it.

Save the original pi_mr (captured at function entry) and restore it on
the out path.

Fixes: 2563e2f30acb ("RDMA/mlx5: Use PA mapping for PI handover")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/hw/mlx5/wr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/mlx5/wr.c b/drivers/infiniband/hw/mlx5/wr.c
index fca9e1d..bb2c603 100644
--- a/drivers/infiniband/hw/mlx5/wr.c
+++ b/drivers/infiniband/hw/mlx5/wr.c
@@ -927,6 +927,7 @@ static noinline_for_stack int handle_reg_mr_integrity(struct mlx5_ib_dev *dev,
 	qp->next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
 
 out:
+	mr->pi_mr = pi_mr;
 	return err;
 }
 
-- 
2.9.4

Re: [PATCH] RDMA/mlx5: Restore mr->pi_mr after temporary stack-local assignment

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> In handle_reg_mr_integrity, when mr->pi_mr is NULL (physical-address
> optimization path), the code points mr->pi_mr at a stack-local pa_pi_mr
> so set_pi_umr_wr can read it during this call. The pointer is never
> restored, so after the function returns mr->pi_mr dangles at a freed stack
> frame. A second IB_WR_REG_MR_INTEGRITY posted on the same MR without
> remapping reads the stale pointer and dereferences it.
> 
> Save the original pi_mr (captured at function entry) and restore it on
> the out path.
> 
> Fixes: 2563e2f30acb ("RDMA/mlx5: Use PA mapping for PI handover")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919100848.2442-1-lirongqing@baidu.com?part=1

Re: [PATCH] RDMA/mlx5: Restore mr->pi_mr after temporary stack-local assignment

[Leon Romanovsky]

On Sat, 19 Sep 2026 18:08:48 +0800, lirongqing wrote:
> In handle_reg_mr_integrity, when mr->pi_mr is NULL (physical-address
> optimization path), the code points mr->pi_mr at a stack-local pa_pi_mr
> so set_pi_umr_wr can read it during this call. The pointer is never
> restored, so after the function returns mr->pi_mr dangles at a freed stack
> frame. A second IB_WR_REG_MR_INTEGRITY posted on the same MR without
> remapping reads the stale pointer and dereferences it.
> 
> [...]

Applied, thanks!

[1/1] RDMA/mlx5: Restore mr->pi_mr after temporary stack-local assignment
      https://git.kernel.org/rdma/rdma/c/9728effe43d8fc

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>