Re: [PATCH 2/4] RDMA/rxe: Reserve MR state during MW binding

[sashiko-bot@kernel.org]

> MR invalidation, fast registration, reregistration, and deregistration
> only test num_mw before changing MR state. A concurrent type-2 MW bind
> can increment num_mw after that test and leave an MW bound to an MR
> that is being destroyed.
> 
> Reserve num_mw == -1 while the MR state is changing, and allow binds
> only while num_mw is nonnegative. This keeps the MW binding count and
> MR lifetime synchronized without adding a new object.
> 
> An unprivileged user with access to the device can use this race to corrupt
> kernel memory and escalate privileges.
> 
> A concurrent bind and deregistration reproducer made KASAN report:
> 
> BUG: KASAN: slab-use-after-free in rxe_mr_copy+0xd5/0x3d0
> [ ... ]
> 
> Fixes: 32a577b4c3a9 ("RDMA/rxe: Add support for bind MW work requests")
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Dongliang Qin <cccccccccccc777777@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928155351.3222978-1-cccccccccccc777777@gmail.com?part=2