[PATCH net] rds: ib: reject FRMR registration before IB connection is established

[PATCH net] rds: ib: reject FRMR registration before IB connection is established

[Weiming Shi]

rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
i_cm_id = NULL because the connection worker has not yet called
rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
the control message before any connection establishment, allowing
rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
kernel.

The existing guard in rds_ib_reg_frmr() only checks for !ic (added in
commit 9e630bcb7701), which does not catch this case since ic is allocated
early and is always non-NULL once the connection object exists.

 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
 RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920
 Call Trace:
  rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167)
  rds_ib_map_frmr (net/rds/ib_frmr.c:252)
  rds_ib_reg_frmr (net/rds/ib_frmr.c:430)
  rds_ib_get_mr (net/rds/ib_rdma.c:615)
  __rds_rdma_map (net/rds/rdma.c:295)
  rds_cmsg_rdma_map (net/rds/rdma.c:860)
  rds_sendmsg (net/rds/send.c:1363)
  ____sys_sendmsg
  do_syscall_64

Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all
non-NULL before proceeding with FRMR registration, mirroring the guard
already present in rds_ib_post_inv(). Return -ENODEV when the connection
is not ready, which the existing error handling in rds_cmsg_send() converts
to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to
start the connection worker.

Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/rds/ib_rdma.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 077f7041df155..2cfec252eeac2 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -604,8 +604,13 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
 		return ibmr;
 	}
 
-	if (conn)
+	if (conn) {
 		ic = conn->c_transport_data;
+		if (!ic || !ic->i_cm_id || !ic->i_cm_id->qp) {
+			ret = -ENODEV;
+			goto out;
+		}
+	}
 
 	if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
 		ret = -ENODEV;
-- 
2.43.0

Re: [PATCH net] rds: ib: reject FRMR registration before IB connection is established

[Jakub Kicinski]

On Tue, 31 Mar 2026 00:32:38 +0800 Weiming Shi wrote:
> rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
> and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
> fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
> i_cm_id = NULL because the connection worker has not yet called
> rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
> RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
> the control message before any connection establishment, allowing
> rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
> kernel.

Allison?

Re: [PATCH net] rds: ib: reject FRMR registration before IB connection is established

[Allison Henderson]

On Tue, 2026-03-31 at 00:32 +0800, Weiming Shi wrote:
> rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
> and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
> fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
> i_cm_id = NULL because the connection worker has not yet called
> rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
> RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
> the control message before any connection establishment, allowing
> rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
> kernel.
> 
> The existing guard in rds_ib_reg_frmr() only checks for !ic (added in
> commit 9e630bcb7701), which does not catch this case since ic is allocated
> early and is always non-NULL once the connection object exists.
> 
>  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
>  RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920
>  Call Trace:
>   rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167)
>   rds_ib_map_frmr (net/rds/ib_frmr.c:252)
>   rds_ib_reg_frmr (net/rds/ib_frmr.c:430)
>   rds_ib_get_mr (net/rds/ib_rdma.c:615)
>   __rds_rdma_map (net/rds/rdma.c:295)
>   rds_cmsg_rdma_map (net/rds/rdma.c:860)
>   rds_sendmsg (net/rds/send.c:1363)
>   ____sys_sendmsg
>   do_syscall_64
> 
> Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all
> non-NULL before proceeding with FRMR registration, mirroring the guard
> already present in rds_ib_post_inv(). Return -ENODEV when the connection
> is not ready, which the existing error handling in rds_cmsg_send() converts
> to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to
> start the connection worker.
> 
> Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>  net/rds/ib_rdma.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
> index 077f7041df155..2cfec252eeac2 100644
> --- a/net/rds/ib_rdma.c
> +++ b/net/rds/ib_rdma.c
> @@ -604,8 +604,13 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
>  		return ibmr;
>  	}
>  
> -	if (conn)
> +	if (conn) {
>  		ic = conn->c_transport_data;
> +		if (!ic || !ic->i_cm_id || !ic->i_cm_id->qp) {
> +			ret = -ENODEV;
> +			goto out;
> +		}
> +	}
>  
>  	if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
>  		ret = -ENODEV;

Hi Weiming,

Apologies for the delay, this looks looks fine to me.  Thanks for catching this.

Reviewed-by: Allison Henderson <achender@kernel.org>

Re: [PATCH net] rds: ib: reject FRMR registration before IB connection is established

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 31 Mar 2026 00:32:38 +0800 you wrote:
> rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
> and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
> fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
> i_cm_id = NULL because the connection worker has not yet called
> rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
> RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
> the control message before any connection establishment, allowing
> rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
> kernel.
> 
> [...]

Here is the summary with links:
  - [net] rds: ib: reject FRMR registration before IB connection is established
    https://git.kernel.org/netdev/net/c/a54ecccfae62

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html