[PATCH rdma-rc] RDMA/siw: Fix use-after-free in siw_mem_id2obj()

[PATCH rdma-rc] RDMA/siw: Fix use-after-free in siw_mem_id2obj()

[Deep Shah]

siw_mem_id2obj() finds a siw_mem with xa_load() under rcu_read_lock()
and then takes a reference with kref_get_unless_zero(). This is only
safe if the object stays allocated until RCU readers are done with it.
siw_free_mem() frees it with kfree() as soon as the last reference is
dropped, so a lookup that races with the final put reads freed memory.

This happens when an MR is deregistered while an incoming RDMA WRITE
looks up its STag:

  BUG: KASAN: slab-use-after-free in siw_mem_id2obj+0xe5/0x310
  Read of size 4 at addr ff110001042aed88 by task repro-rcu2/90
  Call Trace:
   <IRQ>
   siw_mem_id2obj+0xe5/0x310
   siw_proc_write+0x282/0x430
   siw_tcp_rx_data+0x12e/0xbf0
   __tcp_read_sock+0x12c/0x440
   siw_qp_llp_data_ready+0x147/0x260
  Allocated by task 89:
   siw_mr_add_mem+0xb2/0x2a0
   siw_reg_user_mr+0x19f/0x380
   ib_uverbs_reg_mr+0x2a7/0x4c0
  Freed by task 89:
   kfree+0x301/0x530
   siw_dereg_mr+0x31/0x50
   ib_dereg_mr_user+0xb9/0x200

Free siw_mem with kfree_rcu(). A lookup that loses the race then sees
a zero refcount and fails. The umem or PBL is still released at the
last put, since a failed lookup never touches it.

Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
Cc: stable@vger.kernel.org
Signed-off-by: Deep Shah <deepshah146@gmail.com>
---
 drivers/infiniband/sw/siw/siw.h     | 1 +
 drivers/infiniband/sw/siw/siw_mem.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h
index dbc998248b1e..4ec9c2ac75e7 100644
--- a/drivers/infiniband/sw/siw/siw.h
+++ b/drivers/infiniband/sw/siw/siw.h
@@ -157,6 +157,7 @@ struct siw_mem {
 		void *mem_obj;
 	};
 	struct ib_pd *pd;
+	struct rcu_head rcu;
 };
 
 struct siw_mr {
diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
index 2a08817d3cce..be70dc9c8f81 100644
--- a/drivers/infiniband/sw/siw/siw_mem.c
+++ b/drivers/infiniband/sw/siw/siw_mem.c
@@ -115,7 +115,7 @@ void siw_free_mem(struct kref *ref)
 		else
 			kfree(mem->pbl);
 	}
-	kfree(mem);
+	kfree_rcu(mem, rcu);
 }
 
 /*

Re: [PATCH rdma-rc] RDMA/siw: Fix use-after-free in siw_mem_id2obj()

[sashiko-bot]

> siw_mem_id2obj() finds a siw_mem with xa_load() under rcu_read_lock()
> and then takes a reference with kref_get_unless_zero(). This is only
> safe if the object stays allocated until RCU readers are done with it.
> siw_free_mem() frees it with kfree() as soon as the last reference is
> dropped, so a lookup that races with the final put reads freed memory.
> 
> This happens when an MR is deregistered while an incoming RDMA WRITE
> looks up its STag:
> 
>   BUG: KASAN: slab-use-after-free in siw_mem_id2obj+0xe5/0x310
>   Read of size 4 at addr ff110001042aed88 by task repro-rcu2/90
>   Call Trace:
>    <IRQ>
>    siw_mem_id2obj+0xe5/0x310
>    siw_proc_write+0x282/0x430
> [ ... ]
> last put, since a failed lookup never touches it.
> 
> Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Deep Shah <deepshah146@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102064437.23976-1-deepshah146@gmail.com?part=1