Re: [PATCH rdma-next 1/2] RDMA/irdma: Fix potential UAF during SRQ limit AE handling

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] RDMA/irdma: SRQ ID leak in irdma_create_srq() [1]
--

commit df1284da749f5b8315f44692f641894f41a2494c
Author: Jacob Moroni <jmoroni@google.com>

RDMA/irdma: Fix potential UAF during SRQ limit AE handling

This commit replaces the raw SRQ pointer in the AE cookie with the SRQ ID
and uses an XArray lookup with reference counting to prevent
use-after-free during SRQ limit AE processing.

> diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
> index 72de5738ae470..e07b6b40dd992 100644
> --- a/drivers/infiniband/hw/irdma/verbs.c
> +++ b/drivers/infiniband/hw/irdma/verbs.c
[ ... ]
> @@ -2575,6 +2579,7 @@ static int irdma_create_srq(struct ib_srq *ibsrq,
>  		return -EINVAL;
>  
>  	refcount_set(&iwsrq->refcnt, 1);
> +	init_completion(&iwsrq->free_srq);
>  	spin_lock_init(&iwsrq->lock);
>  	err_code = irdma_alloc_rsrc(rf, rf->allocated_srqs, rf->max_srq,
>  				    &iwsrq->srq_num, &rf->next_srq);

[Severity: High]
This problem wasn't introduced by this patch, but does irdma_create_srq()
leak the SRQ ID in iwsrq->srq_num [1] if irdma_get_srqdepth() fails?

drivers/infiniband/hw/irdma/verbs.c:irdma_create_srq() {
	...
	err_code = irdma_alloc_rsrc(rf, rf->allocated_srqs, rf->max_srq,
				    &iwsrq->srq_num, &rf->next_srq);
	if (err_code)
		return err_code;
	...
	err_code = irdma_get_srqdepth(ukinfo->uk_attrs, attr->max_wr,
				      shift, &depth);
	if (err_code)
		return err_code;
	...
}

When irdma_get_srqdepth() rejects invalid attr->max_wr values, returning
directly skips the free_rsrc cleanup path and leaves the bit set in
rf->allocated_srqs, allowing an unprivileged user to exhaust the device's
SRQ ID pool via uverbs.

[1] https://sashiko.dev/#/bug/linux-ec859386-8123-4946-9c12-458c13e3f421

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109202525.2937295-1-jmoroni@google.com?part=1