svcrdma: Fix unmatched rn_unregister on failed accept

Summary

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rn_unregister on failed accept When svc_rdma_accept() takes the errout path before rpcrdma_rn_register() has succeeded, the existing cleanup block calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally. svcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and sc_rn.rn_done is NULL; the unregister therefore xa_erase()s another caller's slot 0 and performs an unmatched kref_put() on the rpcrdma_device's rd_kref. The same errout also brackets the cleanup with svc_xprt_get()/ svc_xprt_put() around the kref_init() birth reference. The kref goes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the net/ns_tracker it pinned) is leaked on every failed accept. rpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc() and kref_get() have both succeeded, so rn_done == NULL is a natural "never registered" sentinel. Guard rpcrdma_rn_unregister() with an early return when rn_done is NULL, and clear rn_done before the matching xa_erase() so a repeated unregister is also a no-op. With that guard in place, the accept errout drops the kref_init() birth reference via svc_xprt_put(), which dispatches svc_rdma_free(). Teardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing IS_ERR/NULL guards in svc_rdma_free(); sc_rn is covered by the new rn_done sentinel; sc_cm_id is non-NULL on every errout path because svc_rdma_accept() dereferences it above the first goto errout. svc_xprt_free() drops the module reference associated with the freed transport, and svc_handle_xprt() drops its pre-acquired reference when ->xpo_accept() returns NULL. Take a replacement module reference before svc_xprt_put() so the two module_put()s remain balanced. The rn_done guard also covers svc_rdma_free()'s non-listener call to rpcrdma_rn_unregister() for transports whose register attempt failed or never ran.

Timeline

1. Sep 24, 2026, 3:21 PM UTCCVE published
2. Oct 19, 2026, 9:07 AM UTCRecord last updated

Affected versions

• Linux Linux

  From cb3cba0ec372fa7c5f5f5c12990bef02e458ab86 · fixed in 0335800071a6dfdf7d21d729b5e7d8fa98936211; From 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932 · fixed in 5aabe070c00e5bdf4ab150fb5f72ad5f266d6241; From 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932 · fixed in 45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2; From 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932 · fixed in 26190394c64c9429481fc88a4738f70bb92fb352; From 6.12.35 · fixed in 6.12.109; From 6.15.4 · fixed in 6.16

• Linux Linux

  6.16

• KernelLinux

  fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.16.0 · fixed in 7.2.4

References 4