[PATCH] RDMA/mlx5: Fix UAF after DEVX DCT create failure

[PATCH] RDMA/mlx5: Fix UAF after DEVX DCT create failure

[Jaeyeong Lee]

The DEVX object create handler destroys and frees a hardware object itself
when copying the command output or setting up an indirect mkey fails.

For DCT objects, mlx5_core_destroy_dct() can fail while leaving the DCT in
qp_table.dct_xa. The error is ignored and the enclosing devx_obj is freed.
A later DCT_DRAINED event then loads the stale xarray entry and calls
complete() on freed memory.

Mark the uobject as holding a valid hardware object immediately after the
DEVX object is initialized. Let the uverbs abort path invoke
devx_obj_cleanup() for subsequent failures. If hardware destruction fails,
rdma_alloc_abort_uobject() commits the uobject instead of freeing it. This
keeps the object alive for cleanup at file close.

A KASAN QEMU reproducer that forces DRAIN_DCT to fail and delivers a
DCT_DRAINED event reports:

  BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
  complete
  rsc_event_notifier

The issue was found with a static analysis tool. OpenAI Codex assisted with
reproducer validation and patch preparation.

Fixes: c5ae1954c47d3 ("IB/mlx5: Use mlx5 core to create/destroy a DEVX DCT")
Cc: stable@vger.kernel.org
Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
---
 drivers/infiniband/hw/mlx5/devx.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index fc6f793dcc658..037c2b6ff9714 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -1535,7 +1535,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 	struct mlx5_ib_ucontext *c = rdma_udata_to_drv_context(
 		&attrs->driver_udata, struct mlx5_ib_ucontext, ibucontext);
 	struct mlx5_ib_dev *dev = to_mdev(c->ibucontext.device);
-	u32 out[MLX5_ST_SZ_DW(general_obj_out_cmd_hdr)];
 	struct devx_obj *obj;
 	u16 obj_type = 0;
 	int err, err2 = 0;
@@ -1613,10 +1612,11 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 	devx_obj_build_destroy_cmd(cmd_in, cmd_out, obj->dinbox, &obj->dinlen,
 				   &obj_id);
 	WARN_ON(obj->dinlen > MLX5_MAX_DESTROY_INBOX_SIZE_DW * sizeof(u32));
+	uverbs_finalize_uobj_create(attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_HANDLE);
 
 	err = uverbs_copy_to(attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_CMD_OUT, cmd_out, cmd_out_len);
 	if (err)
-		goto obj_destroy;
+		return err;
 
 	if (opcode == MLX5_CMD_OP_CREATE_GENERAL_OBJECT)
 		obj_type = MLX5_GET(general_obj_in_cmd_hdr, cmd_in, obj_type);
@@ -1625,18 +1625,10 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 	if (obj->flags & DEVX_OBJ_FLAGS_INDIRECT_MKEY) {
 		err = devx_handle_mkey_indirect(obj, dev, cmd_in, cmd_out);
 		if (err)
-			goto obj_destroy;
+			return err;
 	}
 	return 0;
 
-obj_destroy:
-	if (obj->flags & DEVX_OBJ_FLAGS_DCT)
-		mlx5_core_destroy_dct(obj->ib_dev, &obj->core_dct);
-	else if (obj->flags & DEVX_OBJ_FLAGS_CQ)
-		mlx5_core_destroy_cq(obj->ib_dev->mdev, &obj->core_cq);
-	else
-		mlx5_cmd_exec(obj->ib_dev->mdev, obj->dinbox, obj->dinlen, out,
-			      sizeof(out));
 obj_free:
 	kfree(obj);
 	return err2 ?: err;

Re: [PATCH] RDMA/mlx5: Fix UAF after DEVX DCT create failure

[Leon Romanovsky]

On Wed, Nov 11, 2026 at 10:53:54AM +0000, Jaeyeong Lee wrote:
> The DEVX object create handler destroys and frees a hardware object itself
> when copying the command output or setting up an indirect mkey fails.
> 
> For DCT objects, mlx5_core_destroy_dct() can fail while leaving the DCT in
> qp_table.dct_xa. The error is ignored and the enclosing devx_obj is freed.
> A later DCT_DRAINED event then loads the stale xarray entry and calls
> complete() on freed memory.
> 
> Mark the uobject as holding a valid hardware object immediately after the
> DEVX object is initialized. Let the uverbs abort path invoke
> devx_obj_cleanup() for subsequent failures. If hardware destruction fails,
> rdma_alloc_abort_uobject() commits the uobject instead of freeing it. This
> keeps the object alive for cleanup at file close.
> 
> A KASAN QEMU reproducer that forces DRAIN_DCT to fail and delivers a
> DCT_DRAINED event reports:
> 
>   BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
>   complete
>   rsc_event_notifier

Please resubmit the patch with the full dmesg output and a clear explanation of
what it fixes.

Thanks

> 
> The issue was found with a static analysis tool. OpenAI Codex assisted with
> reproducer validation and patch preparation.
> 
> Fixes: c5ae1954c47d3 ("IB/mlx5: Use mlx5 core to create/destroy a DEVX DCT")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
> ---
>  drivers/infiniband/hw/mlx5/devx.c | 14 +++-----------
>  1 file changed, 3 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
> index fc6f793dcc658..037c2b6ff9714 100644
> --- a/drivers/infiniband/hw/mlx5/devx.c
> +++ b/drivers/infiniband/hw/mlx5/devx.c
> @@ -1535,7 +1535,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  	struct mlx5_ib_ucontext *c = rdma_udata_to_drv_context(
>  		&attrs->driver_udata, struct mlx5_ib_ucontext, ibucontext);
>  	struct mlx5_ib_dev *dev = to_mdev(c->ibucontext.device);
> -	u32 out[MLX5_ST_SZ_DW(general_obj_out_cmd_hdr)];
>  	struct devx_obj *obj;
>  	u16 obj_type = 0;
>  	int err, err2 = 0;
> @@ -1613,10 +1612,11 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  	devx_obj_build_destroy_cmd(cmd_in, cmd_out, obj->dinbox, &obj->dinlen,
>  				   &obj_id);
>  	WARN_ON(obj->dinlen > MLX5_MAX_DESTROY_INBOX_SIZE_DW * sizeof(u32));
> +	uverbs_finalize_uobj_create(attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_HANDLE);
>  
>  	err = uverbs_copy_to(attrs, MLX5_IB_ATTR_DEVX_OBJ_CREATE_CMD_OUT, cmd_out, cmd_out_len);
>  	if (err)
> -		goto obj_destroy;
> +		return err;
>  
>  	if (opcode == MLX5_CMD_OP_CREATE_GENERAL_OBJECT)
>  		obj_type = MLX5_GET(general_obj_in_cmd_hdr, cmd_in, obj_type);
> @@ -1625,18 +1625,10 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  	if (obj->flags & DEVX_OBJ_FLAGS_INDIRECT_MKEY) {
>  		err = devx_handle_mkey_indirect(obj, dev, cmd_in, cmd_out);
>  		if (err)
> -			goto obj_destroy;
> +			return err;
>  	}
>  	return 0;
>  
> -obj_destroy:
> -	if (obj->flags & DEVX_OBJ_FLAGS_DCT)
> -		mlx5_core_destroy_dct(obj->ib_dev, &obj->core_dct);
> -	else if (obj->flags & DEVX_OBJ_FLAGS_CQ)
> -		mlx5_core_destroy_cq(obj->ib_dev->mdev, &obj->core_cq);
> -	else
> -		mlx5_cmd_exec(obj->ib_dev->mdev, obj->dinbox, obj->dinlen, out,
> -			      sizeof(out));
>  obj_free:
>  	kfree(obj);
>  	return err2 ?: err;
>