Re: [PATCH] RDMA/mlx4: Use the right list member in push_deleteing_req()

[sashiko-bot@kernel.org]

> push_deleteing_req() looks up the last pending request from
> group->func[slave].pending, but recovers the enclosing struct with the
> group_list member instead of func_list.
> 
> A struct mcast_req is queued on two lists at once by queue_req():
> group_list links it into group->pending_list and func_list links it
> into group->func[].pending. The two list_head members are adjacent but
> not at the same offset, so list_entry() on a node taken from
> func[].pending yields a pointer 16 bytes past the start of the object.
> 
> The following pend_req->clean then reads past the end of the
> allocation. On x86_64, sizeof(struct mcast_req) is 312 bytes and clean
> is at offset 304; the shifted pointer reads it at offset 320.
> 
> The entry stays on the list when clear_pending_reqs() fails to cancel
> group->timeout_work for the first request, which sets clear to 0 and
> leaves the request queued. push_deleteing_req() is then called right
> afterwards from clean_vf_mcast() and reads the bogus clean field, which
> decides whether the new delete request is dropped.
> 
> Use func_list to recover the request.
> 
> Found by LLM-assisted source review. Not tested on SR-IOV hardware.
> With a test module that calls clean_vf_mcast() on a fabricated group,
> push_deleteing_req() read a marker value placed right after the
> pending request and dropped the new delete request.
> 
> Fixes: b9c5d6a64358 ("IB/mlx4: Add multicast group (MCG) paravirtualization for SR-IOV")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ziheng Wei <zihengw03@163.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115080226.910258-1-zihengw03@163.com?part=1