netdev - RE: [PATCH] RDMA/core: always drop device refcount in ib_del_sub_device_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <SJ0PR12MB6806ACBA1F41F8726F689AABDCB7A@SJ0PR12MB6806.namprd12.prod.outlook.com>
Date: Sun, 21 Dec 2025 06:17:05 +0000
From: Parav Pandit <parav@...dia.com>
To: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>, Mark Zhang
	<markzhang@...dia.com>, Jason Gunthorpe <jgg@...dia.com>, Leon Romanovsky
	<leon@...nel.org>
CC: OFED mailing list <linux-rdma@...r.kernel.org>, Network Development
	<netdev@...r.kernel.org>, Majd Dibbiny <majd@...dia.com>, Doug Ledford
	<dledford@...hat.com>, Yuval Shaia <yshaia@...vell.com>, Bernard Metzler
	<bernard.metzler@...ux.dev>
Subject: RE: [PATCH] RDMA/core: always drop device refcount in
 ib_del_sub_device_and_put()



> From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> Sent: 20 December 2025 07:42 AM
> 
> Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add
> support to add/delete a sub IB device through netlink") grabs a reference
> using ib_device_get_by_index() before calling ib_del_sub_device_and_put(),
> we need to drop that reference before returning -EOPNOTSUPP error.
> 
> Reported-by: syzbot+881d65229ca4f9ae8c84@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
> Fixes: bca51197620a ("RDMA/core: Support IB sub device with type "SMI"")
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> ---
> The reproducer syzbot finally found was not for what I was investigating,
> but this is a bug which I can reproduce and test using the reproducer.
> 
> drivers/infiniband/core/device.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
> index 13e8a1714bbd..1174ab7da629 100644
> --- a/drivers/infiniband/core/device.c
> +++ b/drivers/infiniband/core/device.c
> @@ -2881,8 +2881,10 @@ int ib_del_sub_device_and_put(struct ib_device *sub)
>  {
>  	struct ib_device *parent = sub->parent;
> 
> -	if (!parent)
> +	if (!parent) {
> +		ib_device_put(sub);
>  		return -EOPNOTSUPP;
> +	}
> 
>  	mutex_lock(&parent->subdev_lock);
>  	list_del(&sub->subdev_list);
> --
> 2.47.3
> 
> 

Reviewed-by: Parav Pandit <parav@...dia.com>