linux-kernel - [PATCH] qedr: Fix double free in qedr_alloc_pbl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251110162627.1191740-1-zilin@seu.edu.cn>
Date: Mon, 10 Nov 2025 16:26:27 +0000
From: Zilin Guan <zilin@....edu.cn>
To: mkalderon@...vell.com
Cc: jgg@...pe.ca,
	leon@...nel.org,
	linux-rdma@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	jianhao.xu@....edu.cn,
	Zilin Guan <zilin@....edu.cn>
Subject: [PATCH] qedr: Fix double free in qedr_alloc_pbl_tbl()

In the error path of qedr_alloc_pbl_tbl(), a loop calls
dma_free_coherent() to release previously allocated PBL pages.
However, after the loop, qedr_free_pbl() is called, which attempts
to free the same pages again, resulting in a double-free.

The qedr_free_pbl() function checks if the page pointer is NULL before
freeing. Fix this by setting pbl_table[i].va to NULL after it is freed
in the error-handling loop, thus preventing the subsequent double-free.

Fixes: a7efd7773e31b ("qedr: Add support for PD,PKEY and CQ verbs")
Signed-off-by: Zilin Guan <zilin@....edu.cn>
---
 drivers/infiniband/hw/qedr/verbs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index ab9bf0922979..2dd005a97688 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -561,9 +561,11 @@ static struct qedr_pbl *qedr_alloc_pbl_tbl(struct qedr_dev *dev,
 	return pbl_table;
 
 err:
-	for (i--; i >= 0; i--)
+	for (i--; i >= 0; i--) {
 		dma_free_coherent(&pdev->dev, pbl_info->pbl_size,
 				  pbl_table[i].va, pbl_table[i].pa);
+		pbl_table[i].va = NULL;
+	}
 
 	qedr_free_pbl(dev, pbl_info, pbl_table);
 
-- 
2.34.1