Re: [PATCH] RDMA/ucma: Fix use-after-free in ucma_create_uevent

Re: [PATCH] RDMA/ucma: Fix use-after-free in ucma_create_uevent

[Leon Romanovsky]

On Sun, May 03, 2026 at 04:21:25PM +0530, shaikh.kamal wrote:
> ucma_create_uevent() dereferences event->param.ud.private_data
> as a struct ucma_multicast for multicast events. However,
> this pointer may refer to memory that has already been freed,
> leading to a use-after-free.
> 
> Fix this by avoiding dereferencing private_data for multicast
> events and instead using ctx for uid and id, which has a
> well-defined lifetime.
> 
> Tested by running the reproducer under KASAN with slub_debug
> enabled for several hours with no crashes observed.
> 
> Reported-by: syzbot+a6ffe86390c8a6afc818@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a6ffe86390c8a6afc818
> Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
> 
> Signed-off-by: shaikh.kamal <shaikhkamal2012@gmail.com>
> ---
>  drivers/infiniband/core/ucma.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
> index 6e700b974033..8eef10352af7 100644
> --- a/drivers/infiniband/core/ucma.c
> +++ b/drivers/infiniband/core/ucma.c
> @@ -270,10 +270,12 @@ static struct ucma_event *ucma_create_uevent(struct ucma_context *ctx,
>  	switch (event->event) {
>  	case RDMA_CM_EVENT_MULTICAST_JOIN:
>  	case RDMA_CM_EVENT_MULTICAST_ERROR:
> -		uevent->mc = (struct ucma_multicast *)
> -			     event->param.ud.private_data;
> -		uevent->resp.uid = uevent->mc->uid;
> -		uevent->resp.id = uevent->mc->id;
> +		/*
> +		 * event->param.ud.private_data may point to a ucma_multicast
> +		 * that has already been freed, so use ctx instead.
> +		 */
> +		uevent->resp.uid = ctx->uid;
> +		uevent->resp.id = ctx->id;

I believe your analysis is correct, but the implementation is not.  
Are you certain that `ctx->uid == uevent->mc->uid` and `ctx->id == uevent->mc->id`?

Thanks

>  		break;
>  	default:
>  		uevent->resp.uid = ctx->uid;
> -- 
> 2.43.0
> 
>