Re: [PATCH] RDMA/mlx5: Wait for in-flight page faults on implicit MR null_mkey dereg

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] rdma: kernel panic due to uninitialized waitqueue in mlx5_ib_free_odp_mr
--

commit 86e92de47c6446ff41d57038760ffc2bf8a38827
Author: Li RongQing <lirongqing@baidu.com>

RDMA/mlx5: Wait for in-flight page faults on implicit MR null_mkey dereg

An implicit ODP MR (imr) publishes two mkeys into dev->odp_mkeys: the
main imr->mmkey and imr->null_mmkey (MLX5_MKEY_NULL). This commit ensures
the handling of null_mmkey mirrors the main-mmkey handling by waiting
for any in-flight fault to finish before destroying the mkey.

> diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
> index 8dcbb0e5ccd7c..286d61b582e4d 100644
> --- a/drivers/infiniband/hw/mlx5/odp.c
> +++ b/drivers/infiniband/hw/mlx5/odp.c
> @@ -683,6 +683,8 @@ void mlx5_ib_free_odp_mr(struct mlx5_ib_mr *mr)
>  		xa_erase(&mr_to_mdev(mr)->odp_mkeys,
>  			 mlx5_base_mkey(mr->null_mmkey.key));
>  
> +		mlx5r_deref_wait_odp_mkey(&mr->null_mmkey);

[Severity: Critical]
Will this crash with a NULL pointer dereference when wait queue operations are
performed on an uninitialized waitqueue head?

When a userspace application creates an implicit ODP MR, it is allocated via
mlx5_mr_cache_alloc() in drivers/infiniband/hw/mlx5/mr.c. This function zeroes
the structure and initializes the main mmkey waitqueue, but leaves the
null_mmkey waitqueue zero-initialized:

	init_waitqueue_head(&mr->mmkey.wait);
	/* mr->null_mmkey.wait is left zero-initialized */

When alloc_implicit_mr_null_mkey() sets up the null_mmkey in
drivers/infiniband/hw/mlx5/odp.c, it also skips initializing the waitqueue:

	imr->null_mmkey.type = MLX5_MKEY_NULL;
	/* init_waitqueue_head(&imr->null_mmkey.wait) is missing */

During destruction, __mlx5_ib_dereg_mr() calls mlx5_ib_free_odp_mr() which
executes this new call to mlx5r_deref_wait_odp_mkey(). This performs wait queue
operations on the zero-initialized wait_queue_head. Since the list head is not
initialized, its next pointer is NULL, causing an immediate NULL pointer
dereference.

Unprivileged local users with RDMA access can trigger this reliably, causing
a local denial of service crash.

> +
>  		mlx5_core_destroy_mkey(mr_to_mdev(mr)->mdev,
>  				       mr->null_mmkey.key);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920090613.2186-1-lirongqing@baidu.com?part=1