Re: [PATCH rdma v1] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

[Yishai Hadas]

On 27/04/2026 15:16, Yishai Hadas wrote:
> On 25/04/2026 3:59, Prathamesh Deshpande wrote:
> > MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list
> > before initializing the fields used by the shared error path.
> >
> > If eventfd_ctx_fdget() then fails, the unwind path dereferences
> > event_sub->ev_file in uverbs_uobject_put() and calls
> > subscribe_event_xa_dealloc() with event_sub->xa_key_level1 still unset.
> >
> > Also, if kzalloc_obj() for event_sub fails after
> > subscribe_event_xa_alloc() succeeds, the current iteration is not yet
> > tracked in sub_list, so the shared unwind path cannot undo the XA
> > allocation.
> >
> > Initialize the shared-unwind fields before linking event_sub into
> > sub_list and explicitly unwind the XA allocation on event_sub allocation
> > failure.
> >
> > Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events 
> > over DEVX")
> > Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@xxxxxxxxx>
>
> LGDM
> Reviewed-by: Yishai Hadas <yishaih@xxxxxxxxxx>

Prathamesh,

Please see the below [1] review note from sashiko on your patch, it 
seems right to me.

Can you please come with V2 while addressing it ?

The below [2] chunks on top of your V1 with a proper/improved commit log 
can be considered as a proper solution.

I would add in the commit log something as of that.

"subscribe_event_xa_alloc() created the XA entry exactly once (on the 
first occurrence of KEY_A), so subscribe_event_xa_dealloc() must also be 
called exactly once for it.
Enforcing that by adding a helper function named devx_key_in_sub_list()
and call subscribe_event_xa_dealloc() only once the last occurrence
being cleaned up."

[1] 
https://sashiko.dev/#/patchset/20260425010107.19586-1-prathameshdeshpande7%40gmail.com

[2] diff --git a/drivers/infiniband/hw/mlx5/devx.c 
b/drivers/infiniband/hw/mlx5/devx.c
index 3d1528b1c816..c2ae5a140471 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -1913,6 +1913,17 @@ static int 
UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
        return err;
 }

+static bool devx_key_in_sub_list(struct list_head *list, u32 key_level1)
+{
+       struct devx_event_subscription *s;
+
+       list_for_each_entry(s, list, event_list)
+               if (s->xa_key_level1 == key_level1)
+                       return true;
+
+       return false;
+}
+
 static void
 subscribe_event_xa_dealloc(struct mlx5_devx_event_table *devx_event_table,
                           u32 key_level1,
@@ -2160,10 +2171,11 @@ static int 
UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(

                event_sub = kzalloc_obj(*event_sub);
                if (!event_sub) {
-                       subscribe_event_xa_dealloc(devx_event_table,
-                                                  key_level1,
-                                                  obj,
-                                                  obj_id);
+                       if (!devx_key_in_sub_list(&sub_list, key_level1))
+                               subscribe_event_xa_dealloc(devx_event_table,
+                                                          key_level1,
+                                                          obj,
+                                                          obj_id);
                        err = -ENOMEM;
                        goto err;
                }
@@ -2228,10 +2240,11 @@ static int 
UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
        list_for_each_entry_safe(event_sub, tmp_sub, &sub_list, 
event_list) {
                list_del(&event_sub->event_list);

-               subscribe_event_xa_dealloc(devx_event_table,
-                                          event_sub->xa_key_level1,
-                                          obj,
-                                          obj_id);
+               if (!devx_key_in_sub_list(&sub_list, 
event_sub->xa_key_level1))
+                       subscribe_event_xa_dealloc(devx_event_table,
+                                                  event_sub->xa_key_level1,
+                                                  obj,
+                                                  obj_id);

                if (event_sub->eventfd)
                        eventfd_ctx_put(event_sub->eventfd);

Yishai

> > ---
> >   drivers/infiniband/hw/mlx5/devx.c | 9 ++++++---
> >   1 file changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/ 
> > hw/mlx5/devx.c
> > index 645ebcc0832d..3d1528b1c816 100644
> > --- a/drivers/infiniband/hw/mlx5/devx.c
> > +++ b/drivers/infiniband/hw/mlx5/devx.c
> > @@ -2160,10 +2160,16 @@ static int 
> > UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
> >           event_sub = kzalloc_obj(*event_sub);
> >           if (!event_sub) {
> > +            subscribe_event_xa_dealloc(devx_event_table,
> > +                           key_level1,
> > +                           obj,
> > +                           obj_id);
> >               err = -ENOMEM;
> >               goto err;
> >           }
> > +        event_sub->ev_file = ev_file;
> > +        event_sub->xa_key_level1 = key_level1;
> >           list_add_tail(&event_sub->event_list, &sub_list);
> >           uverbs_uobject_get(&ev_file->uobj);
> >           if (use_eventfd) {
> > @@ -2178,9 +2184,6 @@ static int 
> > UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
> >           }
> >           event_sub->cookie = cookie;
> > -        event_sub->ev_file = ev_file;
> > -        /* May be needed upon cleanup the devx object/subscription */
> > -        event_sub->xa_key_level1 = key_level1;
> >           event_sub->xa_key_level2 = obj_id;
> >           INIT_LIST_HEAD(&event_sub->obj_list);
> >       }