linux-kernel - Re: [syzbot] [rdma?] KASAN: slab-use-after-free Read in ucma_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <686f219f.050a0220.385921.0025.GAE@google.com>
Date: Wed, 09 Jul 2025 19:12:47 -0700
From: syzbot <syzbot+a6ffe86390c8a6afc818@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] [rdma?] KASAN: slab-use-after-free Read in ucma_create_uevent

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: [syzbot] [rdma?] KASAN: slab-use-after-free Read in ucma_create_uevent
Author: lizhi.xu@...driver.com

#syz test

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 9b471548e7ae..9b3051bf5225 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2030,6 +2030,7 @@ static void destroy_mc(struct rdma_id_private *id_priv,
 		}
 		dev_put(ndev);
 
+		printk("cma, mc: %p, %s\n", mc, __func__);
 		cancel_work_sync(&mc->iboe_join.work);
 	}
 	kfree(mc);
@@ -5106,6 +5107,7 @@ void rdma_leave_multicast(struct rdma_cm_id *id, struct sockaddr *addr)
 		spin_unlock_irq(&id_priv->lock);
 
 		WARN_ON(id_priv->cma_dev->device != id->device);
+		printk("cma, mc: %p, id: %p, %s\n", mc, id, __func__);
 		destroy_mc(id_priv, mc);
 		return;
 	}
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 6e700b974033..df3cc11b1ef9 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -272,6 +272,7 @@ static struct ucma_event *ucma_create_uevent(struct ucma_context *ctx,
 	case RDMA_CM_EVENT_MULTICAST_ERROR:
 		uevent->mc = (struct ucma_multicast *)
 			     event->param.ud.private_data;
+		printk("mc: %p, evt: %d, %s\n", uevent->mc, event->event, __func__);
 		uevent->resp.uid = uevent->mc->uid;
 		uevent->resp.id = uevent->mc->id;
 		break;
@@ -1486,6 +1487,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
 	mutex_lock(&ctx->mutex);
 	ret = rdma_join_multicast(ctx->cm_id, (struct sockaddr *)&mc->addr,
 				  join_state, mc);
+	printk("ret: %d, id: %p, mc: %p, %s\n", ret, ctx->cm_id, mc, __func__);
 	mutex_unlock(&ctx->mutex);
 	if (ret)
 		goto err_xa_erase;
@@ -1504,6 +1506,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
 
 err_leave_multicast:
 	mutex_lock(&ctx->mutex);
+	printk("id: %p, %s\n", ctx->cm_id, __func__);
 	rdma_leave_multicast(ctx->cm_id, (struct sockaddr *) &mc->addr);
 	mutex_unlock(&ctx->mutex);
 	ucma_cleanup_mc_events(mc);