Re: [PATCH net v2] rds: ib: Clear the sg list when mapping an MR fails

[Allison Henderson]

On Tue, 2026-09-22 at 11:15 +0800, Dongliang Qin wrote:
> rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
> mapping and registration can fail. On failure, __rds_rdma_map() unpins
> the pages and frees the scatterlist, but rds_ib_free_frmr() can still
> return the MR to the pool with the stale pointer set.
> 
> This leaves the pool with a dangling scatterlist and can lead to local
> privilege escalation. KASAN detects the resulting use-after-free when the
> MR is later torn down:
> 
> BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
> Read of size 8
> 
> Call Trace:
>  __rds_ib_teardown_mr
>  rds_ib_unreg_frmr
>  rds_ib_flush_mr_pool
>  rds_ib_flush_mrs
>  rds_free_mr
>  rds_setsockopt
> 
> Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
> mapping fails, return directly while the MR fields remain clear; the caller
> keeps ownership of the scatterlist and its pinned pages. If a later
> registration step fails, unmap the scatterlist and clear the MR fields
> before returning.
> 
> Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Dongliang Qin <cccccccccccc777777@xxxxxxxxx>

New v2 looks good to me.  Thanks!

Reviewed-by: Allison Henderson <achender@xxxxxxxxxx>
Allison

> ---
> Changes in v2:
> - Store the scatterlist in the MR only after DMA mapping succeeds.
> - Return directly if DMA mapping fails, leaving the MR fields clear.
> - Link to v1: https://lore.kernel.org/netdev/20260920063449.1594203-1-cccccccccccc777777@xxxxxxxxx/
> 
> net/rds/ib_frmr.c | 11 +++++------
> 1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
> index bd8611911..8397aa4a1 100644
> --- a/net/rds/ib_frmr.c
> +++ b/net/rds/ib_frmr.c
> @@ -204,19 +204,16 @@ static int rds_ib_map_frmr(struct rds_ib_device *rds_ibdev,
>  	 */
>  	rds_ib_teardown_mr(ibmr);
>  
> -	ibmr->sg = sg;
> -	ibmr->sg_len = sg_len;
> -	ibmr->sg_dma_len = 0;
>  	frmr->sg_byte_len = 0;
> -	WARN_ON(ibmr->sg_dma_len);
> -	ibmr->sg_dma_len = ib_dma_map_sg(dev, ibmr->sg, ibmr->sg_len,
> +	ibmr->sg_dma_len = ib_dma_map_sg(dev, sg, sg_len,
>  					 DMA_BIDIRECTIONAL);
>  	if (unlikely(!ibmr->sg_dma_len)) {
>  		pr_warn("RDS/IB: %s failed!\n", __func__);
>  		return -EBUSY;
>  	}
>  
> -	frmr->sg_byte_len = 0;
> +	ibmr->sg = sg;
> +	ibmr->sg_len = sg_len;
>  	frmr->dma_npages = 0;
>  	len = 0;
>  
> @@ -264,6 +261,8 @@ static int rds_ib_map_frmr(struct rds_ib_device *rds_ibdev,
>  	ib_dma_unmap_sg(rds_ibdev->dev, ibmr->sg, ibmr->sg_len,
>  			DMA_BIDIRECTIONAL);
>  	ibmr->sg_dma_len = 0;
> +	ibmr->sg = NULL;
> +	ibmr->sg_len = 0;
>  	return ret;
>  }
>