rdmavt AllocDevice UAF

Vulnerability analysis

When the rdmavt RDMA driver sets up a new device, it creates the main device structure first, then tries to allocate memory for the per-port data. If that second allocation fails, the driver frees the device structure but accidentally returns the now-stale pointer instead of NULL. Callers assume any non-NULL result is valid and use it, accessing memory that has already been released. The fix makes the driver return NULL immediately after freeing, so callers properly detect the failure. The bug is reached during RDMA device initialization when the driver loads, typically automatic when hfi1 or qib InfiniBand hardware is present. An unprivileged local user can trigger the allocation failure by causing system-wide memory pressure, though exploiting the use-after-free would also require careful heap manipulation to replace the freed object with attacker-controlled data.