[PATCH] RDMA/mlx5: Fix UAF after DEVX DCT create failure

[Jaeyeong Lee <lee@jaeyeong.cc>]

The DEVX object create handler destroys and frees a hardware object itself
when copying the command output or setting up an indirect mkey fails.

For DCT objects, mlx5_core_destroy_dct() can fail while leaving the DCT in
qp_table.dct_xa. The error is ignored and the enclosing devx_obj is freed.
A later DCT_DRAINED event then loads the stale xarray entry and calls
complete() on freed memory.

Mark the uobject as holding a valid hardware object immediately after the
DEVX object is initialized. Let the uverbs abort path invoke
devx_obj_cleanup() for subsequent failures. If hardware destruction fails,
rdma_alloc_abort_uobject() commits the uobject instead of freeing it. This
keeps the object alive for cleanup at file close.

A KASAN QEMU reproducer that forces DRAIN_DCT to fail and delivers a
DCT_DRAINED event reports:

  BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
  complete
  rsc_event_notifier

The issue was found with a static analysis tool. OpenAI Codex assisted with
reproducer validation and patch preparation.

Fixes: c5ae1954c47d3 ("IB/mlx5: Use mlx5 core to create/destroy a DEVX DCT")
Cc: stable@vger.kernel.org
Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
---
 drivers/infiniband/hw/mlx5/devx.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index fc6f793dcc658..037c2b6ff9714 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -1535,7 +1535,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 	struct mlx5_ib_ucontext *c = rdma_udata_to_drv_context(
 		&attrs->driver_udata, struct mlx5_ib_ucontext, ibucontext);
 	struct mlx5_ib_dev *dev = to_mdev(c->ibucontext.device);
-	u32 out[MLX5_ST_SZ_DW(general_obj_out_cmd_hdr)];
 	struct devx_obj *obj;
 	u16 obj_type = 0;
 	int err, err2 = 0;
@@ -1613,10 +1612,11 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 	devx_obj_build_destroy_cmd(cmd_in, cmd_out, obj->dinbox, &obj->dinlen,
 				   &obj_id);
 	WARN_ON(obj->dinlen > MLX5_MAX_DESTROY_INBOX_SIZE_DW * sizeof(u32));
+	uverbs_finalize_uobj_create(attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_HANDLE);
 
 	err = uverbs_copy_to(attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_CMD_OUT, cmd_out, cmd_out_len);
 	if (err)
-		goto obj_destroy;
+		return err;
 
 	if (opcode == MLX5_CMD_OP_CREATE_GENERAL_OBJECT)
 		obj_type = MLX5_GET(general_obj_in_cmd_hdr, cmd_in, obj_type);
@@ -1625,18 +1625,10 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 	if (obj->flags & DEVX_OBJ_FLAGS_INDIRECT_MKEY) {
 		err = devx_handle_mkey_indirect(obj, dev, cmd_in, cmd_out);
 		if (err)
-			goto obj_destroy;
+			return err;
 	}
 	return 0;
 
-obj_destroy:
-	if (obj->flags & DEVX_OBJ_FLAGS_DCT)
-		mlx5_core_destroy_dct(obj->ib_dev, &obj->core_dct);
-	else if (obj->flags & DEVX_OBJ_FLAGS_CQ)
-		mlx5_core_destroy_cq(obj->ib_dev->mdev, &obj->core_cq);
-	else
-		mlx5_cmd_exec(obj->ib_dev->mdev, obj->dinbox, obj->dinlen, out,
-			      sizeof(out));
 obj_free:
 	kfree(obj);
 	return err2 ?: err;