[PATCH rdma-next 1/3] RDMA/mlx4: Fix stale umem and MTT state after rereg_mr failures

[PATCH rdma-next 1/3] RDMA/mlx4: Fix stale umem and MTT state after rereg_mr failures

[Jacob Moroni]

During rereg_mr, the umem is released in various failure cases
but mmr->umem was left pointing to a freed umem, so it could end
up getting double-freed when the MR is finally deregistered, or
cause a UAF in ib_umem_check_rereg() if another rereg_mr attempt
is made.

Fix this by setting mmr->umem to NULL after ib_umem_release().

Additionally, when mlx4_mr_rereg_mem_write() fails, mtt.order is
left set but with an invalid offset, so during dereg,
mlx4_mtt_cleanup() ends up freeing an MTT range that was never
allocated. Fix this by resetting mtt.order to -1 in that path.

Fixes: 9376932d0c26 ("IB/mlx4_ib: Add support for user MR re-registration")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
---
 drivers/infiniband/hw/mlx4/mr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index a6b4abce1bfe..e7f524c28f1e 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -268,6 +268,8 @@ struct ib_mr *mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, u64 start,
 					      *pmpt_entry);
 		if (err) {
 			ib_umem_release(mmr->umem);
+			mmr->mmr.mtt.order = -1;
+			mmr->umem = NULL;
 			goto release_mpt_entry;
 		}
 		mmr->mmr.iova       = virt_addr;
@@ -277,6 +279,7 @@ struct ib_mr *mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, u64 start,
 		if (err) {
 			mlx4_mr_rereg_mem_cleanup(dev->dev, &mmr->mmr);
 			ib_umem_release(mmr->umem);
+			mmr->umem = NULL;
 			goto release_mpt_entry;
 		}
 	}
-- 
2.56.0.313.g2479322e68-goog