Re: [PATCH rdma-next v2 0/8] RDMA/core: Fix restrack UAF in destroy flows

[Leon Romanovsky]

On Mon, 13 Jul 2026 18:37:59 +0300, Edward Srouji wrote:
> The resource-tracking (restrack) database is the back-end for the netlink
> "rdma resource show" interface which pins objects with
> rdma_restrack_get().
> 
> QP/CQ/SRQ/PD/DMAH/counter destroy paths currently call
> rdma_restrack_del() at the very end of ib_destroy_*_user() (or its
> equivalent), i.e. after device->ops.destroy_*() has already freed the
> vendor object. A concurrent netlink dump can therefore look the entry
> up, take a reference via rdma_restrack_get(), and then dereference
> already freed memory - most visibly through ib_query_qp() during
> fill_res_qp_entry_query(), which produced the crash logged in patch 2.
> 
> [...]

Applied, thanks!

[1/8] RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
      https://git.kernel.org/rdma/rdma/c/bbb475bfdaaa42
[2/8] RDMA/core: Fix use after free in ib_query_qp()
      https://git.kernel.org/rdma/rdma/c/b027f665a1a1f0
[3/8] RDMA/core: Fix potential use after free in ib_destroy_cq_user()
      https://git.kernel.org/rdma/rdma/c/06d2f10ba8f7f4
[4/8] RDMA/core: Fix potential use after free in ib_destroy_srq_user()
      https://git.kernel.org/rdma/rdma/c/fb392e7746a25f
[5/8] RDMA/core: Fix potential use after free in counter_release()
      https://git.kernel.org/rdma/rdma/c/fb538c8aa2795d
[6/8] RDMA/core: Fix potential use after free in ib_free_cq()
      https://git.kernel.org/rdma/rdma/c/06178024942778
[7/8] RDMA/core: Fix potential use after free in uverbs_free_dmah()
      https://git.kernel.org/rdma/rdma/c/f42597bc8ed68c
[8/8] RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
      https://git.kernel.org/rdma/rdma/c/a8bfb98690fe18

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>