Re: [PATCH v2] RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

[Leon Romanovsky]

On Thu, Sep 03, 2026 at 03:47:42PM +0530, Jeffin Philip wrote:
> iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()
> making it accessible to global list where another CPU can kref_get()
> on nlmsg_request causing a refcount "addition on 0" bug. Fix this
> by initializing kref _before_ list_add_tail() so refcount for
> nlmsg_request can be incremented/decremented normally. In addition,
> also initialize every field before list_add_tail().
> 
> Reported-by: syzbot+bd317784d628820741b5@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=bd317784d628820741b5
> Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jeffin Philip <jeffinphilip14@xxxxxxxxx>
> ---
> Changelog:
>    Changes in v2:
>       Add list_add_tail() last after initializing every field as per Leon Romanovsky's
>    suggestion.
> ---
>  drivers/infiniband/core/iwpm_util.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)

The patch doesn't apply and please send it as standalone patch and not
as Reply-to.

Thanks