[PATCH] RDMA/ucma: Fix use-after-free in ucma_create_uevent

[shaikh.kamal]

ucma_create_uevent() dereferences event->param.ud.private_data
as a struct ucma_multicast for multicast events. However,
this pointer may refer to memory that has already been freed,
leading to a use-after-free.

Fix this by avoiding dereferencing private_data for multicast
events and instead using ctx for uid and id, which has a
well-defined lifetime.

Tested by running the reproducer under KASAN with slub_debug
enabled for several hours with no crashes observed.

Reported-by: syzbot+a6ffe86390c8a6afc818@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=a6ffe86390c8a6afc818
Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")

Signed-off-by: shaikh.kamal <shaikhkamal2012@xxxxxxxxx>
---
 drivers/infiniband/core/ucma.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 6e700b974033..8eef10352af7 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -270,10 +270,12 @@ static struct ucma_event *ucma_create_uevent(struct ucma_context *ctx,
 	switch (event->event) {
 	case RDMA_CM_EVENT_MULTICAST_JOIN:
 	case RDMA_CM_EVENT_MULTICAST_ERROR:
-		uevent->mc = (struct ucma_multicast *)
-			     event->param.ud.private_data;
-		uevent->resp.uid = uevent->mc->uid;
-		uevent->resp.id = uevent->mc->id;
+		/*
+		 * event->param.ud.private_data may point to a ucma_multicast
+		 * that has already been freed, so use ctx instead.
+		 */
+		uevent->resp.uid = ctx->uid;
+		uevent->resp.id = ctx->id;
 		break;
 	default:
 		uevent->resp.uid = ctx->uid;
-- 
2.43.0