[PATCH] RDMA/iwpm: fix kref bypass in iwpm_add_and_query_mapping() error path

[PATCH] RDMA/iwpm: fix kref bypass in iwpm_add_and_query_mapping() error path

[Wentao Liang]

iwpm_get_nlmsg_request() returns with kref_init() + kref_get()
(refcount=2). iwpm_add_and_query_mapping() calls
iwpm_free_nlmsg_request() directly on the error path instead of
using kref_put(), freeing the object while the refcount is still
non-zero. The success path correctly uses kref_put() via
iwpm_wait_complete_req().

Replace the direct iwpm_free_nlmsg_request() call with
kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request).

Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/infiniband/core/iwpm_msg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 854c974d6586..bac3d1f321ab 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -296,7 +296,7 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
 query_mapping_error_nowarn:
 	dev_kfree_skb(skb);
 	if (nlmsg_request)
-		iwpm_free_nlmsg_request(&nlmsg_request->kref);
+		kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
 	return ret;
 }
 
-- 
2.34.1

Re: [PATCH] RDMA/iwpm: fix kref bypass in iwpm_add_and_query_mapping() error path

[Leon Romanovsky]

On Mon, Jun 08, 2026 at 03:42:08PM +0000, Wentao Liang wrote:
> iwpm_get_nlmsg_request() returns with kref_init() + kref_get()
> (refcount=2). iwpm_add_and_query_mapping() calls
> iwpm_free_nlmsg_request() directly on the error path instead of
> using kref_put(), freeing the object while the refcount is still
> non-zero. The success path correctly uses kref_put() via
> iwpm_wait_complete_req().
> 
> Replace the direct iwpm_free_nlmsg_request() call with
> kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request).
> 
> Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/infiniband/core/iwpm_msg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
> index 854c974d6586..bac3d1f321ab 100644
> --- a/drivers/infiniband/core/iwpm_msg.c
> +++ b/drivers/infiniband/core/iwpm_msg.c
> @@ -296,7 +296,7 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
>  query_mapping_error_nowarn:
>  	dev_kfree_skb(skb);
>  	if (nlmsg_request)
> -		iwpm_free_nlmsg_request(&nlmsg_request->kref);
> +		kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);

You should consolidate all related changes in iwpm_msg.c into a single patch.
You also overlooked updating iwpm_add_mapping().

Thanks

>  	return ret;
>  }
>  
> -- 
> 2.34.1
>