* [PATCH rdma v1] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
@ 2026-04-25 0:59 Prathamesh Deshpande
2026-04-27 12:16 ` Yishai Hadas
0 siblings, 1 reply; 4+ messages in thread
From: Prathamesh Deshpande @ 2026-04-25 0:59 UTC (permalink / raw)
To: jgg, leon; +Cc: yishaih, linux-rdma, linux-kernel, Prathamesh Deshpande
MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list
before initializing the fields used by the shared error path.
If eventfd_ctx_fdget() then fails, the unwind path dereferences
event_sub->ev_file in uverbs_uobject_put() and calls
subscribe_event_xa_dealloc() with event_sub->xa_key_level1 still unset.
Also, if kzalloc_obj() for event_sub fails after
subscribe_event_xa_alloc() succeeds, the current iteration is not yet
tracked in sub_list, so the shared unwind path cannot undo the XA
allocation.
Initialize the shared-unwind fields before linking event_sub into
sub_list and explicitly unwind the XA allocation on event_sub allocation
failure.
Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
---
drivers/infiniband/hw/mlx5/devx.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index 645ebcc0832d..3d1528b1c816 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -2160,10 +2160,16 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
event_sub = kzalloc_obj(*event_sub);
if (!event_sub) {
+ subscribe_event_xa_dealloc(devx_event_table,
+ key_level1,
+ obj,
+ obj_id);
err = -ENOMEM;
goto err;
}
+ event_sub->ev_file = ev_file;
+ event_sub->xa_key_level1 = key_level1;
list_add_tail(&event_sub->event_list, &sub_list);
uverbs_uobject_get(&ev_file->uobj);
if (use_eventfd) {
@@ -2178,9 +2184,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
}
event_sub->cookie = cookie;
- event_sub->ev_file = ev_file;
- /* May be needed upon cleanup the devx object/subscription */
- event_sub->xa_key_level1 = key_level1;
event_sub->xa_key_level2 = obj_id;
INIT_LIST_HEAD(&event_sub->obj_list);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH rdma v1] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
2026-04-25 0:59 [PATCH rdma v1] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Prathamesh Deshpande
@ 2026-04-27 12:16 ` Yishai Hadas
2026-04-28 14:55 ` Yishai Hadas
0 siblings, 1 reply; 4+ messages in thread
From: Yishai Hadas @ 2026-04-27 12:16 UTC (permalink / raw)
To: Prathamesh Deshpande, jgg, leon; +Cc: linux-rdma, linux-kernel, yishaih
On 25/04/2026 3:59, Prathamesh Deshpande wrote:
> MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list
> before initializing the fields used by the shared error path.
>
> If eventfd_ctx_fdget() then fails, the unwind path dereferences
> event_sub->ev_file in uverbs_uobject_put() and calls
> subscribe_event_xa_dealloc() with event_sub->xa_key_level1 still unset.
>
> Also, if kzalloc_obj() for event_sub fails after
> subscribe_event_xa_alloc() succeeds, the current iteration is not yet
> tracked in sub_list, so the shared unwind path cannot undo the XA
> allocation.
>
> Initialize the shared-unwind fields before linking event_sub into
> sub_list and explicitly unwind the XA allocation on event_sub allocation
> failure.
>
> Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX")
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
LGDM
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
> ---
> drivers/infiniband/hw/mlx5/devx.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
> index 645ebcc0832d..3d1528b1c816 100644
> --- a/drivers/infiniband/hw/mlx5/devx.c
> +++ b/drivers/infiniband/hw/mlx5/devx.c
> @@ -2160,10 +2160,16 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
>
> event_sub = kzalloc_obj(*event_sub);
> if (!event_sub) {
> + subscribe_event_xa_dealloc(devx_event_table,
> + key_level1,
> + obj,
> + obj_id);
> err = -ENOMEM;
> goto err;
> }
>
> + event_sub->ev_file = ev_file;
> + event_sub->xa_key_level1 = key_level1;
> list_add_tail(&event_sub->event_list, &sub_list);
> uverbs_uobject_get(&ev_file->uobj);
> if (use_eventfd) {
> @@ -2178,9 +2184,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
> }
>
> event_sub->cookie = cookie;
> - event_sub->ev_file = ev_file;
> - /* May be needed upon cleanup the devx object/subscription */
> - event_sub->xa_key_level1 = key_level1;
> event_sub->xa_key_level2 = obj_id;
> INIT_LIST_HEAD(&event_sub->obj_list);
> }
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH rdma v1] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
2026-04-27 12:16 ` Yishai Hadas
@ 2026-04-28 14:55 ` Yishai Hadas
2026-04-28 22:49 ` Prathamesh Deshpande
0 siblings, 1 reply; 4+ messages in thread
From: Yishai Hadas @ 2026-04-28 14:55 UTC (permalink / raw)
To: Prathamesh Deshpande, jgg, leon; +Cc: linux-rdma, linux-kernel
On 27/04/2026 15:16, Yishai Hadas wrote:
> On 25/04/2026 3:59, Prathamesh Deshpande wrote:
>> MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list
>> before initializing the fields used by the shared error path.
>>
>> If eventfd_ctx_fdget() then fails, the unwind path dereferences
>> event_sub->ev_file in uverbs_uobject_put() and calls
>> subscribe_event_xa_dealloc() with event_sub->xa_key_level1 still unset.
>>
>> Also, if kzalloc_obj() for event_sub fails after
>> subscribe_event_xa_alloc() succeeds, the current iteration is not yet
>> tracked in sub_list, so the shared unwind path cannot undo the XA
>> allocation.
>>
>> Initialize the shared-unwind fields before linking event_sub into
>> sub_list and explicitly unwind the XA allocation on event_sub allocation
>> failure.
>>
>> Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events
>> over DEVX")
>> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
>
> LGDM
> Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Prathamesh,
Please see the below [1] review note from sashiko on your patch, it
seems right to me.
Can you please come with V2 while addressing it ?
The below [2] chunks on top of your V1 with a proper/improved commit log
can be considered as a proper solution.
I would add in the commit log something as of that.
"subscribe_event_xa_alloc() created the XA entry exactly once (on the
first occurrence of KEY_A), so subscribe_event_xa_dealloc() must also be
called exactly once for it.
Enforcing that by adding a helper function named devx_key_in_sub_list()
and call subscribe_event_xa_dealloc() only once the last occurrence
being cleaned up."
[1]
https://sashiko.dev/#/patchset/20260425010107.19586-1-prathameshdeshpande7%40gmail.com
[2] diff --git a/drivers/infiniband/hw/mlx5/devx.c
b/drivers/infiniband/hw/mlx5/devx.c
index 3d1528b1c816..c2ae5a140471 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -1913,6 +1913,17 @@ static int
UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
return err;
}
+static bool devx_key_in_sub_list(struct list_head *list, u32 key_level1)
+{
+ struct devx_event_subscription *s;
+
+ list_for_each_entry(s, list, event_list)
+ if (s->xa_key_level1 == key_level1)
+ return true;
+
+ return false;
+}
+
static void
subscribe_event_xa_dealloc(struct mlx5_devx_event_table *devx_event_table,
u32 key_level1,
@@ -2160,10 +2171,11 @@ static int
UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
event_sub = kzalloc_obj(*event_sub);
if (!event_sub) {
- subscribe_event_xa_dealloc(devx_event_table,
- key_level1,
- obj,
- obj_id);
+ if (!devx_key_in_sub_list(&sub_list, key_level1))
+ subscribe_event_xa_dealloc(devx_event_table,
+ key_level1,
+ obj,
+ obj_id);
err = -ENOMEM;
goto err;
}
@@ -2228,10 +2240,11 @@ static int
UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
list_for_each_entry_safe(event_sub, tmp_sub, &sub_list,
event_list) {
list_del(&event_sub->event_list);
- subscribe_event_xa_dealloc(devx_event_table,
- event_sub->xa_key_level1,
- obj,
- obj_id);
+ if (!devx_key_in_sub_list(&sub_list,
event_sub->xa_key_level1))
+ subscribe_event_xa_dealloc(devx_event_table,
+ event_sub->xa_key_level1,
+ obj,
+ obj_id);
if (event_sub->eventfd)
eventfd_ctx_put(event_sub->eventfd);
Yishai
>
>> ---
>> drivers/infiniband/hw/mlx5/devx.c | 9 ++++++---
>> 1 file changed, 6 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/
>> hw/mlx5/devx.c
>> index 645ebcc0832d..3d1528b1c816 100644
>> --- a/drivers/infiniband/hw/mlx5/devx.c
>> +++ b/drivers/infiniband/hw/mlx5/devx.c
>> @@ -2160,10 +2160,16 @@ static int
>> UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
>> event_sub = kzalloc_obj(*event_sub);
>> if (!event_sub) {
>> + subscribe_event_xa_dealloc(devx_event_table,
>> + key_level1,
>> + obj,
>> + obj_id);
>> err = -ENOMEM;
>> goto err;
>> }
>> + event_sub->ev_file = ev_file;
>> + event_sub->xa_key_level1 = key_level1;
>> list_add_tail(&event_sub->event_list, &sub_list);
>> uverbs_uobject_get(&ev_file->uobj);
>> if (use_eventfd) {
>> @@ -2178,9 +2184,6 @@ static int
>> UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
>> }
>> event_sub->cookie = cookie;
>> - event_sub->ev_file = ev_file;
>> - /* May be needed upon cleanup the devx object/subscription */
>> - event_sub->xa_key_level1 = key_level1;
>> event_sub->xa_key_level2 = obj_id;
>> INIT_LIST_HEAD(&event_sub->obj_list);
>> }
>
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH rdma v1] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
2026-04-28 14:55 ` Yishai Hadas
@ 2026-04-28 22:49 ` Prathamesh Deshpande
0 siblings, 0 replies; 4+ messages in thread
From: Prathamesh Deshpande @ 2026-04-28 22:49 UTC (permalink / raw)
To: yishaih; +Cc: jgg, leon, linux-kernel, linux-rdma, prathameshdeshpande7
On 28 Apr 2026 17:55:22 +0300, Yishai Hadas wrote:
> Can you please come with V2 while addressing it ?
Thanks for the feedback, Yishai. I have sent v2 which addresses these points.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-04-28 22:49 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-25 0:59 [PATCH rdma v1] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Prathamesh Deshpande
2026-04-27 12:16 ` Yishai Hadas
2026-04-28 14:55 ` Yishai Hadas
2026-04-28 22:49 ` Prathamesh Deshpande
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox