Forwarded: [PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table

[syzbot <syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master


Commit 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
converted alloc_gid_table() to use kzalloc_flex(), which allocates
the ib_gid_table struct and its trailing data_vec flex array member
in a single contiguous slab block.

However, release_gid_table() was not updated accordingly and still
calls kfree(table->data_vec), passing a pointer that points 216 bytes
into the middle of the slab object rather than its head. This is an
invalid free which KASAN catches as:

  BUG: KASAN: invalid-free in release_gid_table+0x384/0x470

Since data_vec is now a flex array member of ib_gid_table, it is
freed implicitly when kfree(table) is called. Remove the redundant
and invalid kfree(table->data_vec).

Fixes: 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
Reported-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4334f9a250019c1b79b4
Signed-off-by: Deepanshu <your@email.com>
---
 drivers/infiniband/core/cache.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 896486fa6185..647a547e2d7f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -801,7 +801,6 @@ static void release_gid_table(struct ib_device *device,
 	}
 
 	mutex_destroy(&table->lock);
-	kfree(table->data_vec);
 	kfree(table);
 }
 
-- 
2.43.0