[PATCH rc 0/4] Fix several serious mistakes on the udata path in drivers

[PATCH rc 0/4] Fix several serious mistakes on the udata path in drivers

[Jason Gunthorpe]

While converting drivers to use
ib_copy_validate_udata_in()/ib_respond_udata()/etc these issues were
found, mostly by AI scanners.

Jason Gunthorpe (4):
  RDMA/efa: Fix typo in efa_alloc_mr()
  IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
  RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
  RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

 drivers/infiniband/hw/efa/efa_verbs.c           | 2 +-
 drivers/infiniband/hw/ionic/ionic_controlpath.c | 2 +-
 drivers/infiniband/hw/irdma/verbs.c             | 2 +-
 drivers/infiniband/hw/mthca/mthca_provider.c    | 2 ++
 4 files changed, 5 insertions(+), 3 deletions(-)


base-commit: d6c58f4eb3d00a695f5a610ea780cad322ec714e
-- 
2.43.0

[PATCH rc 1/4] RDMA/efa: Fix typo in efa_alloc_mr()

[Jason Gunthorpe]

The pattern is to check the entire driver request space, not just
sizeof something unrelated.

Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index 22d3e25c3b9d11..c066cd84aa6407 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -1667,7 +1667,7 @@ static struct efa_mr *efa_alloc_mr(struct ib_pd *ibpd, int access_flags,
 	struct efa_mr *mr;
 
 	if (udata && udata->inlen &&
-	    !ib_is_udata_cleared(udata, 0, sizeof(udata->inlen))) {
+	    !ib_is_udata_cleared(udata, 0, udata->inlen)) {
 		ibdev_dbg(&dev->ibdev,
 			  "Incompatible ABI params, udata not cleared\n");
 		return ERR_PTR(-EINVAL);
-- 
2.43.0

[PATCH rc 2/4] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()

[Jason Gunthorpe]

Fix a user triggerable leak on the system call failure path.

Cc: stable@vger.kernel.org
Fixes: ec34a922d243 ("[PATCH] IB/mthca: Add SRQ implementation")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/mthca/mthca_provider.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index dd572d76866c2e..ae0c8024ad2310 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -428,6 +428,8 @@ static int mthca_create_srq(struct ib_srq *ibsrq,
 
 	if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
 		mthca_free_srq(to_mdev(ibsrq->device), srq);
+		mthca_unmap_user_db(to_mdev(ibsrq->device), &context->uar,
+				    context->db_tab, ucmd.db_index);
 		return -EFAULT;
 	}
 
-- 
2.43.0

[PATCH rc 3/4] RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()

[Jason Gunthorpe]

struct irdma_create_ah_resp {  // 8 bytes, no padding
    __u32 ah_id;               // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx)
    __u8  rsvd[4];             // offset 4 - NEVER SET <- LEAK
};

rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().

The reserved members of the structure were not zeroed.

Cc: stable@vger.kernel.org
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/irdma/verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index cf8d1915057402..afc41619a0abc4 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -5212,7 +5212,7 @@ static int irdma_create_user_ah(struct ib_ah *ibah,
 #define IRDMA_CREATE_AH_MIN_RESP_LEN offsetofend(struct irdma_create_ah_resp, rsvd)
 	struct irdma_ah *ah = container_of(ibah, struct irdma_ah, ibah);
 	struct irdma_device *iwdev = to_iwdev(ibah->pd->device);
-	struct irdma_create_ah_resp uresp;
+	struct irdma_create_ah_resp uresp = {};
 	struct irdma_ah *parent_ah;
 	int err;
 
-- 
2.43.0

[PATCH rc 4/4] RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

[Jason Gunthorpe]

struct ionic_cq_resp resp {
    __u32 cqid[2];         // offset 0 - PARTIALLY SET (see below)
    __u8  udma_mask;       // offset 8 - SET (resp.udma_mask = vcq->udma_mask)
    __u8  rsvd[7];         // offset 9 - NEVER SET <- LEAK
};

rsvd[7]: 7 bytes of stack memory leaked unconditionally.

cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices
where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but
udma_count could be 1, meaning cqid[1] might never be written via
ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4
bytes) is also leaked. So potentially 11 bytes leaked.

Cc: stable@vger.kernel.org
Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/ionic/ionic_controlpath.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/ionic/ionic_controlpath.c b/drivers/infiniband/hw/ionic/ionic_controlpath.c
index ea12d9b8e125fe..83573721af2c08 100644
--- a/drivers/infiniband/hw/ionic/ionic_controlpath.c
+++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c
@@ -1218,7 +1218,7 @@ int ionic_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 		rdma_udata_to_drv_context(udata, struct ionic_ctx, ibctx);
 	struct ionic_vcq *vcq = to_ionic_vcq(ibcq);
 	struct ionic_tbl_buf buf = {};
-	struct ionic_cq_resp resp;
+	struct ionic_cq_resp resp = {};
 	struct ionic_cq_req req;
 	int udma_idx = 0, rc;
 
-- 
2.43.0

Re: [PATCH rc 1/4] RDMA/efa: Fix typo in efa_alloc_mr()

[Michael Margolin]

On Mon, Feb 16, 2026 at 11:02:47AM -0400, Jason Gunthorpe wrote:w3esq23

> The pattern is to check the entire driver request space, not just
> sizeof something unrelated.
> 
> Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
> index 22d3e25c3b9d11..c066cd84aa6407 100644
> --- a/drivers/infiniband/hw/efa/efa_verbs.c
> +++ b/drivers/infiniband/hw/efa/efa_verbs.c
> @@ -1667,7 +1667,7 @@ static struct efa_mr *efa_alloc_mr(struct ib_pd *ibpd, int access_flags,
>  	struct efa_mr *mr;
>  
>  	if (udata && udata->inlen &&
> -	    !ib_is_udata_cleared(udata, 0, sizeof(udata->inlen))) {
> +	    !ib_is_udata_cleared(udata, 0, udata->inlen)) {
>  		ibdev_dbg(&dev->ibdev,
>  			  "Incompatible ABI params, udata not cleared\n");
>  		return ERR_PTR(-EINVAL);
> -- 
> 2.43.0
>

Thanks!

Acked-by: Michael Margolin <mrgolin@amazon.com>

Re: [PATCH rc 2/4] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()

[Leon Romanovsky]

On Mon, Feb 16, 2026 at 11:02:48AM -0400, Jason Gunthorpe wrote:
> Fix a user triggerable leak on the system call failure path.
> 
> Cc: stable@vger.kernel.org
> Fixes: ec34a922d243 ("[PATCH] IB/mthca: Add SRQ implementation")
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  drivers/infiniband/hw/mthca/mthca_provider.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
> index dd572d76866c2e..ae0c8024ad2310 100644
> --- a/drivers/infiniband/hw/mthca/mthca_provider.c
> +++ b/drivers/infiniband/hw/mthca/mthca_provider.c
> @@ -428,6 +428,8 @@ static int mthca_create_srq(struct ib_srq *ibsrq,
>  
>  	if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
>  		mthca_free_srq(to_mdev(ibsrq->device), srq);
> +		mthca_unmap_user_db(to_mdev(ibsrq->device), &context->uar,
> +				    context->db_tab, ucmd.db_index);
>  		return -EFAULT;
>  	}

The `mthca_destroy_srq()` implementation needs to be corrected as well.
Its resource release order is currently reversed.

Thanks

>  
> -- 
> 2.43.0
> 

Re: [PATCH rc 2/4] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()

[Jason Gunthorpe]

On Tue, Feb 17, 2026 at 03:23:56PM +0200, Leon Romanovsky wrote:
> > @@ -428,6 +428,8 @@ static int mthca_create_srq(struct ib_srq *ibsrq,
> >  
> >  	if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
> >  		mthca_free_srq(to_mdev(ibsrq->device), srq);
> > +		mthca_unmap_user_db(to_mdev(ibsrq->device), &context->uar,
> > +				    context->db_tab, ucmd.db_index);
> >  		return -EFAULT;
> >  	}
> 
> The `mthca_destroy_srq()` implementation needs to be corrected as well.
> Its resource release order is currently reversed.

Er, that looks OK, this is probably in the wrong order, let's should swap
it, though I'm not sure it is even order sensitive..

Jason

Re: [PATCH rc 2/4] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()

[Leon Romanovsky]

On Tue, Feb 17, 2026 at 07:46:27PM -0400, Jason Gunthorpe wrote:
> On Tue, Feb 17, 2026 at 03:23:56PM +0200, Leon Romanovsky wrote:
> > > @@ -428,6 +428,8 @@ static int mthca_create_srq(struct ib_srq *ibsrq,
> > >  
> > >  	if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
> > >  		mthca_free_srq(to_mdev(ibsrq->device), srq);
> > > +		mthca_unmap_user_db(to_mdev(ibsrq->device), &context->uar,
> > > +				    context->db_tab, ucmd.db_index);
> > >  		return -EFAULT;
> > >  	}
> > 
> > The `mthca_destroy_srq()` implementation needs to be corrected as well.
> > Its resource release order is currently reversed.
> 
> Er, that looks OK, this is probably in the wrong order, let's should swap
> it, though I'm not sure it is even order sensitive..

Yes, mthca_destroy_srq() in the wrong order.

Thanks

> 
> Jason

Re: [PATCH rc 4/4] RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

[Abhijit Gangurde]

Thanks!

Acked-by: Abhijit Gangurde <abhijit.gangurde@amd.com>

On 2/16/26 20:32, Jason Gunthorpe wrote:
> struct ionic_cq_resp resp {
>      __u32 cqid[2];         // offset 0 - PARTIALLY SET (see below)
>      __u8  udma_mask;       // offset 8 - SET (resp.udma_mask = vcq->udma_mask)
>      __u8  rsvd[7];         // offset 9 - NEVER SET <- LEAK
> };
>
> rsvd[7]: 7 bytes of stack memory leaked unconditionally.
>
> cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices
> where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but
> udma_count could be 1, meaning cqid[1] might never be written via
> ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4
> bytes) is also leaked. So potentially 11 bytes leaked.
>
> Cc: stable@vger.kernel.org
> Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path")
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>   drivers/infiniband/hw/ionic/ionic_controlpath.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/hw/ionic/ionic_controlpath.c b/drivers/infiniband/hw/ionic/ionic_controlpath.c
> index ea12d9b8e125fe..83573721af2c08 100644
> --- a/drivers/infiniband/hw/ionic/ionic_controlpath.c
> +++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c
> @@ -1218,7 +1218,7 @@ int ionic_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
>   		rdma_udata_to_drv_context(udata, struct ionic_ctx, ibctx);
>   	struct ionic_vcq *vcq = to_ionic_vcq(ibcq);
>   	struct ionic_tbl_buf buf = {};
> -	struct ionic_cq_resp resp;
> +	struct ionic_cq_resp resp = {};
>   	struct ionic_cq_req req;
>   	int udma_idx = 0, rc;
>   

Re: [PATCH rc 0/4] Fix several serious mistakes on the udata path in drivers

[Leon Romanovsky]

On Mon, 16 Feb 2026 11:02:46 -0400, Jason Gunthorpe wrote:
> While converting drivers to use
> ib_copy_validate_udata_in()/ib_respond_udata()/etc these issues were
> found, mostly by AI scanners.
> 
> Jason Gunthorpe (4):
>   RDMA/efa: Fix typo in efa_alloc_mr()
>   IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
>   RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
>   RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
> 
> [...]

Applied, thanks!

[1/4] RDMA/efa: Fix typo in efa_alloc_mr()
      https://git.kernel.org/rdma/rdma/c/f22c77ce49db05
[2/4] IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
      https://git.kernel.org/rdma/rdma/c/117942ca43e2e3
[3/4] RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
      https://git.kernel.org/rdma/rdma/c/74586c6da9ea22
[4/4] RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
      https://git.kernel.org/rdma/rdma/c/faa72102b178c7

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>