[PATCH] RDMA/erdma: fix use-after-free in CEQ tasklet teardown

[PATCH] RDMA/erdma: fix use-after-free in CEQ tasklet teardown

[Fan Wu]

The CEQ interrupt handler schedules a tasklet that accesses the CEQ
buffers. During teardown, erdma_free_ceq_irq() removes the interrupt
handler and waits for any in-flight handler invocation, but does not
wait for a tasklet that was already scheduled by that handler.

erdma_ceq_uninit_one() can then free the EQ qbuf and dbrec while the
tasklet is still accessing them.

Call tasklet_kill() after free_irq(). This prevents new tasklet
scheduling and waits for any already scheduled tasklet before the EQ
buffers are freed.

This issue was found by an in-house static analysis tool.

Fixes: f2a0a630b953 ("RDMA/erdma: Add event queue implementation")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/infiniband/hw/erdma/erdma_eq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
index 6486234a2360..78ebec6d48a3 100644
--- a/drivers/infiniband/hw/erdma/erdma_eq.c
+++ b/drivers/infiniband/hw/erdma/erdma_eq.c
@@ -219,6 +219,7 @@ static void erdma_free_ceq_irq(struct erdma_dev *dev, u16 ceqn)

 	irq_set_affinity_hint(eqc->irq.msix_vector, NULL);
 	free_irq(eqc->irq.msix_vector, eqc);
+	tasklet_kill(&dev->ceqs[ceqn].tasklet);
 }

 static int create_eq_cmd(struct erdma_dev *dev, u32 eqn, struct erdma_eq *eq)
--
2.34.1

Re: [PATCH] RDMA/erdma: fix use-after-free in CEQ tasklet teardown

[Cheng Xu]

On 7/21/26 9:37 PM, Fan Wu wrote:
> The CEQ interrupt handler schedules a tasklet that accesses the CEQ
> buffers. During teardown, erdma_free_ceq_irq() removes the interrupt
> handler and waits for any in-flight handler invocation, but does not
> wait for a tasklet that was already scheduled by that handler.
> 
> erdma_ceq_uninit_one() can then free the EQ qbuf and dbrec while the
> tasklet is still accessing them.
> 
> Call tasklet_kill() after free_irq(). This prevents new tasklet
> scheduling and waits for any already scheduled tasklet before the EQ
> buffers are freed.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: f2a0a630b953 ("RDMA/erdma: Add event queue implementation")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
> ---
>  drivers/infiniband/hw/erdma/erdma_eq.c | 1 +
>  1 file changed, 1 insertion(+)
> 

Hi, Fan Wu,

Thanks your work! But there is another patch fixes this issue already:

https://lore.kernel.org/linux-rdma/CAHYDg1QDaWPxD7pb-A1ZmqxaX6YACWTsinzEG4_EZDKbAX38kQ@mail.gmail.com/T/#t

Thanks,
Cheng Xu

> diff --git a/drivers/infiniband/hw/erdma/erdma_eq.c b/drivers/infiniband/hw/erdma/erdma_eq.c
> index 6486234a2360..78ebec6d48a3 100644
> --- a/drivers/infiniband/hw/erdma/erdma_eq.c
> +++ b/drivers/infiniband/hw/erdma/erdma_eq.c
> @@ -219,6 +219,7 @@ static void erdma_free_ceq_irq(struct erdma_dev *dev, u16 ceqn)
> 
>  	irq_set_affinity_hint(eqc->irq.msix_vector, NULL);
>  	free_irq(eqc->irq.msix_vector, eqc);
> +	tasklet_kill(&dev->ceqs[ceqn].tasklet);
>  }
> 
>  static int create_eq_cmd(struct erdma_dev *dev, u32 eqn, struct erdma_eq *eq)
> --
> 2.34.1