[PATCH net] net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

[PATCH net] net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

[Weiming Shi]

rds_ib_xmit_atomic() always programs a masked atomic opcode
(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)
for every RDS atomic cmsg.  But the completion-side switch in
rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked
atomic completion falls through to default and returns rm == NULL while
send->s_op is left set.  rds_ib_send_cqe_handler() then dereferences the
NULL rm via rm->m_final_op, oopsing in softirq context.  An unprivileged
AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection
triggers it; on hardware that natively accepts masked atomics (mlx4,
mlx5) no extra setup is needed.

  RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!
  Oops: general protection fault [#1] SMP KASAN
  KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
  RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)
  Call Trace:
   <IRQ>
   rds_ib_send_cqe_handler (net/rds/ib_send.c:282)
   poll_scq (net/rds/ib_cm.c:274)
   rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)
   tasklet_action_common (kernel/softirq.c:943)
   handle_softirqs (kernel/softirq.c:573)
   run_ksoftirqd (kernel/softirq.c:479)
   </IRQ>
  Kernel panic - not syncing: Fatal exception in interrupt

Handle the masked atomic opcodes in the same case as the non-masked
ones: they map to the same struct rds_message.atomic union member, so
the existing container_of()/rds_ib_send_unmap_atomic() body is correct
for them.

Fixes: 20c72bd5f5f9 ("RDS: Implement masked atomic operations")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/rds/ib_send.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index fcd04c29f543..d6be95542119 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -170,6 +170,8 @@ static struct rds_message *rds_ib_send_unmap_op(struct rds_ib_connection *ic,
 		break;
 	case IB_WR_ATOMIC_FETCH_AND_ADD:
 	case IB_WR_ATOMIC_CMP_AND_SWP:
+	case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
+	case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
 		if (send->s_op) {
 			rm = container_of(send->s_op, struct rds_message, atomic);
 			rds_ib_send_unmap_atomic(ic, send->s_op, wc_status);
-- 
2.43.0

Re: [PATCH net] net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

[Allison Henderson]

On Sat, 2026-06-06 at 12:24 -0700, Weiming Shi wrote:
> rds_ib_xmit_atomic() always programs a masked atomic opcode
> (IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)
> for every RDS atomic cmsg.  But the completion-side switch in
> rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked
> atomic completion falls through to default and returns rm == NULL while
> send->s_op is left set.  rds_ib_send_cqe_handler() then dereferences the
> NULL rm via rm->m_final_op, oopsing in softirq context.  An unprivileged
> AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection
> triggers it; on hardware that natively accepts masked atomics (mlx4,
> mlx5) no extra setup is needed.
> 
>   RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!
>   Oops: general protection fault [#1] SMP KASAN
>   KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
>   RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)
>   Call Trace:
>    <IRQ>
>    rds_ib_send_cqe_handler (net/rds/ib_send.c:282)
>    poll_scq (net/rds/ib_cm.c:274)
>    rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)
>    tasklet_action_common (kernel/softirq.c:943)
>    handle_softirqs (kernel/softirq.c:573)
>    run_ksoftirqd (kernel/softirq.c:479)
>    </IRQ>
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Handle the masked atomic opcodes in the same case as the non-masked
> ones: they map to the same struct rds_message.atomic union member, so
> the existing container_of()/rds_ib_send_unmap_atomic() body is correct
> for them.
> 
> Fixes: 20c72bd5f5f9 ("RDS: Implement masked atomic operations")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Hi Weiming,

Thanks for the thorough writeup, I've traced through the logic and the
fix looks correct to me as do the tags.  Thanks for catching this!

Reviewed-by: Allison Henderson <achender@kernel.org>
Allison

> ---
>  net/rds/ib_send.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
> index fcd04c29f543..d6be95542119 100644
> --- a/net/rds/ib_send.c
> +++ b/net/rds/ib_send.c
> @@ -170,6 +170,8 @@ static struct rds_message *rds_ib_send_unmap_op(struct rds_ib_connection *ic,
>  		break;
>  	case IB_WR_ATOMIC_FETCH_AND_ADD:
>  	case IB_WR_ATOMIC_CMP_AND_SWP:
> +	case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
> +	case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
>  		if (send->s_op) {
>  			rm = container_of(send->s_op, struct rds_message, atomic);
>  			rds_ib_send_unmap_atomic(ic, send->s_op, wc_status);