Re: [PATCH net v2] rds: ib: Clear the sg list when mapping an MR fails

[sashiko-bot@kernel.org]

> rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
> mapping and registration can fail. On failure, __rds_rdma_map() unpins
> the pages and frees the scatterlist, but rds_ib_free_frmr() can still
> return the MR to the pool with the stale pointer set.
> 
> This leaves the pool with a dangling scatterlist and can lead to local
> privilege escalation. KASAN detects the resulting use-after-free when the
> MR is later torn down:
> 
> BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
> Read of size 8
> 
> Call Trace:
>  __rds_ib_teardown_mr
>  rds_ib_unreg_frmr
>  rds_ib_flush_mr_pool
>  rds_ib_flush_mrs
>  rds_free_mr
>  rds_setsockopt
> 
> Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
> mapping fails, return directly while the MR fields remain clear; the caller
> keeps ownership of the scatterlist and its pinned pages. If a later
> registration step fails, unmap the scatterlist and clear the MR fields
> before returning.
> 
> Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dongliang Qin <cccccccccccc777777@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922031546.3874605-1-cccccccccccc777777@gmail.com?part=1