Skip to contentSkip to conversation

IB/mlx4: Fix use-after-free on pkey sysfs registration failure

PATCH Applied Shuangpeng Bai 2 participants 2 messages Aug 16 – Sep 1

Subsystems (3)
Stable branch InfiniBand Mellanox MLX4 IB driver
lore
Share & tools
lore

Shuangpeng Bai

author
#0 lore raw

PATCH 1/1 IB/mlx4: Fix use-after-free on pkey sysfs registration failure

register_pkey_tree() ignores errors from register_one_pkey_tree() and continues registering the remaining slaves. The per-slave error path has already released the pkey parent kobjects, but their pointers remain stored in the device. A later device cleanup therefore passes the stale pointers to kobject_put(), causing a use-after-free.

Clear the parent pointers after releasing a failed slave tree and skip unregistered trees during device cleanup. This preserves the existing best-effort registration behavior while preventing a second cleanup of the failed tree.

Fixes c1e7e466120b ("IB/mlx4: Add iov directory in sysfs under the ib device")
Cc [email protected]
Signed-off-by Shuangpeng Bai <[email protected]>
---
 drivers/infiniband/hw/mlx4/sysfs.c | 4 ++++
 1 file changed, 4 insertions(+)
drivers/infiniband/hw/mlx4/sysfs.c +4 -0
index e688ad66a895..5438224bf325 100644
@@ -751,11 +751,13 @@ static int register_one_pkey_tree(struct mlx4_ib_dev *dev, int slave)
 		kobject_put(p);
 	}
 	kobject_put(dev->dev_ports_parent[slave]);
+	dev->dev_ports_parent[slave] = NULL;
 
 err_ports:
 	kobject_put(dev->pkeys.device_parent[slave]);
 	/* extra put for the device_parent create_and_add */
 	kobject_put(dev->pkeys.device_parent[slave]);
+	dev->pkeys.device_parent[slave] = NULL;
 
 fail_dev:
 	kobject_put(dev->iov_parent);

@@ -785,6 +787,8 @@ static void unregister_pkey_tree(struct mlx4_ib_dev *device)
 		return;
 
 	for (slave = device->dev->persist->num_vfs; slave >= 0; --slave) {
+		if (!device->pkeys.device_parent[slave])
+			continue;
 		list_for_each_entry_safe(p, t,
 					 &device->pkeys.pkey_port_list[slave],
 					 entry) {
Signature · 1 line
2.43.0
Applied
#1 lore raw
Quoted 6 lines · Shuangpeng Bai

register_pkey_tree() ignores errors from register_one_pkey_tree() and continues registering the remaining slaves. The per-slave error path has already released the pkey parent kobjects, but their pointers remain stored in the device. A later device cleanup therefore passes the stale pointers to kobject_put(), causing a use-after-free.

Quoted 6 lines

Clear the parent pointers after releasing a failed slave tree and skip unregistered trees during device cleanup. This preserves the existing best-effort registration behavior while preventing a second cleanup of the failed tree.

[...]

Applied, thanks!

[1/1] IB/mlx4: Fix use-after-free on pkey sysfs registration failure

      https://git.kernel.org/rdma/rdma/c/1af874e9f4ce22

Best regards,

Signature · 1 line
Leon Romanovsky <[email protected]>