Re: [PATCH net v2] net/rds: Do not unpin a page after a failed atomic pin

[Allison Henderson <achender@kernel.org>]

On Fri, 2026-11-06 at 20:18 -0800, Kyle Zeng wrote:
> rds_cmsg_atomic() assumes that a non-NULL output from rds_pin_pages()
> represents a pin that it owns. However, pin_user_pages_fast() can roll
> back a fast-GUP pin after racing fork() and then fail in the slow path,
> for example after a concurrent mprotect(PROT_NONE). The output slot can
> still contain the already-unpinned page.
> 
> The common error path calls unpin_user_page() on that stale pointer.
> This can consume another subsystem's pin and allow the page to be freed
> while it is still in use. A local unprivileged reproducer triggers a
> KASAN use-after-free write through an io_uring registered buffer.
> 
> Clear page when rds_pin_pages() does not return one. The error path
> continues to release the page on errors after a successful pin, and
> successful requests retain their existing ownership and behavior. All
> four RDS atomic ancillary operations share this path.
> 
> The issue was found by an LLM.
> 
> Fixes: 15133f6e67d8 ("RDS: Implement atomic operations")
> Cc: stable@kernel.org
Just for future reference, stable@kernel.org is for unpublished security
bugs and stable@vger.kernel.org is for known bugs.  No need to resend,
stable will still find it, but just an fyi for next time.

> Signed-off-by: Kyle Zeng <kylebot@openai.com>
This version looks good to me, thanks Kyle!

Reviewed-by: Allison Henderson <achender@kernel.org>

> ---
> v2: Use the net subject prefix, add Fixes and stable Cc tags, and
>     include the validation results.
> v1: https://lore.kernel.org/r/20261030042110.73571-1-kylebot@openai.com
> 
> I have a reproducer for this issue and can share via DM
> 
>  net/rds/rdma.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/rds/rdma.c b/net/rds/rdma.c
> index 078090d292fa..71b57abb96c4 100644
> --- a/net/rds/rdma.c
> +++ b/net/rds/rdma.c
> @@ -957,8 +957,11 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,
>  	}
>  
>  	ret = rds_pin_pages(args->local_addr, 1, &page, 1);
> -	if (ret != 1)
> +	if (ret != 1) {
> +		/* A failed pin can leave a stale page pointer. */
> +		page = NULL;
>  		goto err;
> +	}
>  	ret = 0;
>  
>  	sg_set_page(rm->atomic.op_sg, page, 8, offset_in_page(args->local_addr));
> 
> base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d