Re: [PATCH net] rds: ib: reject FRMR registration before IB connection is established

[Allison Henderson <achender@kernel.org>]

On Tue, 2026-03-31 at 00:32 +0800, Weiming Shi wrote:
> rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
> and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
> fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
> i_cm_id = NULL because the connection worker has not yet called
> rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
> RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
> the control message before any connection establishment, allowing
> rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
> kernel.
> 
> The existing guard in rds_ib_reg_frmr() only checks for !ic (added in
> commit 9e630bcb7701), which does not catch this case since ic is allocated
> early and is always non-NULL once the connection object exists.
> 
>  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
>  RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920
>  Call Trace:
>   rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167)
>   rds_ib_map_frmr (net/rds/ib_frmr.c:252)
>   rds_ib_reg_frmr (net/rds/ib_frmr.c:430)
>   rds_ib_get_mr (net/rds/ib_rdma.c:615)
>   __rds_rdma_map (net/rds/rdma.c:295)
>   rds_cmsg_rdma_map (net/rds/rdma.c:860)
>   rds_sendmsg (net/rds/send.c:1363)
>   ____sys_sendmsg
>   do_syscall_64
> 
> Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all
> non-NULL before proceeding with FRMR registration, mirroring the guard
> already present in rds_ib_post_inv(). Return -ENODEV when the connection
> is not ready, which the existing error handling in rds_cmsg_send() converts
> to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to
> start the connection worker.
> 
> Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>  net/rds/ib_rdma.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
> index 077f7041df155..2cfec252eeac2 100644
> --- a/net/rds/ib_rdma.c
> +++ b/net/rds/ib_rdma.c
> @@ -604,8 +604,13 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
>  		return ibmr;
>  	}
>  
> -	if (conn)
> +	if (conn) {
>  		ic = conn->c_transport_data;
> +		if (!ic || !ic->i_cm_id || !ic->i_cm_id->qp) {
> +			ret = -ENODEV;
> +			goto out;
> +		}
> +	}
>  
>  	if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
>  		ret = -ENODEV;

Hi Weiming,

Apologies for the delay, this looks looks fine to me.  Thanks for catching this.

Reviewed-by: Allison Henderson <achender@kernel.org>