[PATCH] RDMA/rtrs: Register client event handler after capability check

[Jaeyeong Lee]

rtrs_clt_ib_dev_init() registers dev->event_handler before checking
IB_DEVICE_MEM_MGT_EXTENSIONS. If the device does not provide that
capability, init returns -ENOTSUPP and rtrs_ib_dev_find_or_add() frees
dev through out_free_pd without calling the deinit callback. The embedded
event handler therefore remains on the IB device's list after its storage
has been freed.

A later IB event walks the dangling list entry and accesses freed memory.
The issue was found by static analysis. A focused out-of-tree test module
on an x86_64 QEMU/KASAN kernel temporarily cleared only
IB_DEVICE_MEM_MGT_EXTENSIONS on a SIW device, exercised the real
rtrs_clt_ib_dev_init() callback through rtrs_ib_dev_find_or_add(), restored
the capabilities, and dispatched IB_EVENT_DEVICE_FATAL. KASAN reported
an 8-byte slab-use-after-free read in ib_dispatch_event_clients(), with
both the allocation and free originating in rtrs_ib_dev_find_or_add().

Move the capability check before event handler registration. The check is
a prerequisite for successful client initialization. Registration cannot
fail and init returns success immediately afterwards, so every installed
handler is now owned by a successfully initialized device and is removed
by the existing deinit callback.

Fixes: 667db86bcbe8 ("RDMA/rtrs: Register ib event handler")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jaeyeong Lee <lee@xxxxxxxxxxx>
Acked-by: Jack Wang <jinpu.wang@xxxxxxxxxxxxxxx>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index bf3a0377da3ff..85eaa2bdb4704 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -3191,16 +3191,16 @@ void rtrs_clt_ib_event_handler(struct ib_event_handler *handler,
 
 static int rtrs_clt_ib_dev_init(struct rtrs_ib_dev *dev)
 {
-	INIT_IB_EVENT_HANDLER(&dev->event_handler, dev->ib_dev,
-			      rtrs_clt_ib_event_handler);
-	ib_register_event_handler(&dev->event_handler);
-
 	if (!(dev->ib_dev->attrs.device_cap_flags &
 	      IB_DEVICE_MEM_MGT_EXTENSIONS)) {
 		pr_err("Memory registrations not supported.\n");
 		return -ENOTSUPP;
 	}
 
+	INIT_IB_EVENT_HANDLER(&dev->event_handler, dev->ib_dev,
+			      rtrs_clt_ib_event_handler);
+	ib_register_event_handler(&dev->event_handler);
+
 	return 0;
 }
 
-- 
2.43.0