Re: [PATCH net v2] rds: ib: Clear the sg list when mapping an MR fails

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Tue, 22 Sep 2026 11:15:45 +0800 you wrote:
> rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
> mapping and registration can fail. On failure, __rds_rdma_map() unpins
> the pages and frees the scatterlist, but rds_ib_free_frmr() can still
> return the MR to the pool with the stale pointer set.
> 
> This leaves the pool with a dangling scatterlist and can lead to local
> privilege escalation. KASAN detects the resulting use-after-free when the
> MR is later torn down:
> 
> [...]

Here is the summary with links:
  - [net,v2] rds: ib: Clear the sg list when mapping an MR fails
    https://git.kernel.org/netdev/net/c/58eb1b3325ed

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html