Re: [PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table

[Deepanshu Kartikey]

On Wed, Apr 1, 2026 at 6:58 AM Deepanshu Kartikey <kartikey406@xxxxxxxxx> wrote:
>
> Commit 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
> converted alloc_gid_table() to use kzalloc_flex(), which allocates
> the ib_gid_table struct and its trailing data_vec flex array member
> in a single contiguous slab block.
>
> However, release_gid_table() was not updated accordingly and still
> calls kfree(table->data_vec), passing a pointer that points 216 bytes
> into the middle of the slab object rather than its head. This is an
> invalid free which KASAN catches as:
>
>   BUG: KASAN: invalid-free in release_gid_table+0x384/0x470
>
> Since data_vec is now a flex array member of ib_gid_table, it is
> freed implicitly when kfree(table) is called. Remove the redundant
> and invalid kfree(table->data_vec).
>
> Fixes: 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
> Reported-by: syzbot+4334f9a250019c1b79b4@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=4334f9a250019c1b79b4
> Tested-by: syzbot+4334f9a250019c1b79b4@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
> ---
>  drivers/infiniband/core/cache.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
> index 896486fa6185..647a547e2d7f 100644
> --- a/drivers/infiniband/core/cache.c
> +++ b/drivers/infiniband/core/cache.c
> @@ -801,7 +801,6 @@ static void release_gid_table(struct ib_device *device,
>         }
>
>         mutex_destroy(&table->lock);
> -       kfree(table->data_vec);
>         kfree(table);
>  }
>
> --
> 2.43.0
>

Gentle ping on this patch. Please let me know the status of this patch.

Thanks

Deepanshu Kartikey