Re: [PATCH net] net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

[Weiming Shi <bestswngs@gmail.com>]

On 26-06-07 12:32, Allison Henderson wrote:
> On Sat, 2026-06-06 at 12:24 -0700, Weiming Shi wrote:
> > rds_ib_xmit_atomic() always programs a masked atomic opcode
> > (IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)
> > for every RDS atomic cmsg.  But the completion-side switch in
> > rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked
> > atomic completion falls through to default and returns rm == NULL while
> > send->s_op is left set.  rds_ib_send_cqe_handler() then dereferences the
> > NULL rm via rm->m_final_op, oopsing in softirq context.  An unprivileged
> > AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection
> > triggers it; on hardware that natively accepts masked atomics (mlx4,
> > mlx5) no extra setup is needed.
> > 
> >   RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!
> >   Oops: general protection fault [#1] SMP KASAN
> >   KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
> >   RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)
> >   Call Trace:
> >    <IRQ>
> >    rds_ib_send_cqe_handler (net/rds/ib_send.c:282)
> >    poll_scq (net/rds/ib_cm.c:274)
> >    rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)
> >    tasklet_action_common (kernel/softirq.c:943)
> >    handle_softirqs (kernel/softirq.c:573)
> >    run_ksoftirqd (kernel/softirq.c:479)
> >    </IRQ>
> >   Kernel panic - not syncing: Fatal exception in interrupt
> > 
> > Handle the masked atomic opcodes in the same case as the non-masked
> > ones: they map to the same struct rds_message.atomic union member, so
> > the existing container_of()/rds_ib_send_unmap_atomic() body is correct
> > for them.
> > 
> > Fixes: 20c72bd5f5f9 ("RDS: Implement masked atomic operations")
> > Reported-by: Xiang Mei <xmei5@asu.edu>
> > Assisted-by: Claude:claude-opus-4-8
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> 
> Hi Weiming,
> 
> Thanks for the thorough writeup, I've traced through the logic and the
> fix looks correct to me as do the tags.  Thanks for catching this!
> 
> Reviewed-by: Allison Henderson <achender@kernel.org>
> Allison
> 
> > ---
> >  net/rds/ib_send.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
> > index fcd04c29f543..d6be95542119 100644
> > --- a/net/rds/ib_send.c
> > +++ b/net/rds/ib_send.c
> > @@ -170,6 +170,8 @@ static struct rds_message *rds_ib_send_unmap_op(struct rds_ib_connection *ic,
> >  		break;
> >  	case IB_WR_ATOMIC_FETCH_AND_ADD:
> >  	case IB_WR_ATOMIC_CMP_AND_SWP:
> > +	case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
> > +	case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
> >  		if (send->s_op) {
> >  			rm = container_of(send->s_op, struct rds_message, atomic);
> >  			rds_ib_send_unmap_atomic(ic, send->s_op, wc_status);
> 

Thanks for your review.