From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f51.google.com (mail-qv1-f51.google.com [209.85.219.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DCC8C28727D for ; Thu, 28 May 2026 17:04:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779987891; cv=none; b=ZquNUecb3tMX0K1rs+RsCB7AEoFTUfQ+bcu7gcZ7k/6+hfHZZnQFqhlm19XUZ3faNg0U1BaRc9aRZ9WU/OuCB26TaixYcQ5RRtN+OP6vmJQxeqoIP9Moqxc8hrNn4eg+uKWTkcyZOhk562VQNcFDPHc4R6OaPC+0ZNvBlEbzPKE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779987891; c=relaxed/simple; bh=kOHe2QUTHD+mFExERu5r4+hz2wPW3d+FJkflRwKHtYA=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=MdkkQdUB62O6SbUR4Jprfm6YOltA3V8Im/uo6zRgKe2D3UdSEHC2cGMc4XF4i6fV2WQITx2BCPyIx7PCQ5yhBFJlr8gul4es6bcJQS5MSj2vJT+b2nsbg3/mQed5E3ivKqMMT+PF0kQqoWrcXJyK+Hk/5Tie0SKe4POTKEsWnbI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Nb6tibzU; arc=none smtp.client-ip=209.85.219.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Nb6tibzU" Received: by mail-qv1-f51.google.com with SMTP id 6a1803df08f44-8c9166b26b4so151464536d6.0 for ; Thu, 28 May 2026 10:04:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779987889; x=1780592689; darn=vger.kernel.org; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=MVvKmQSUVNcPGnpeO8ALn7LkyX+WnGR/CwcsH9fvnZM=; b=Nb6tibzUAr2B8xnx/A50B+Y+uJrRYWVnKIEIVm2/WLA1I+Z+EGsip79XoTPq8l0GIx pRIYcLwiZ4ACXDrGIix/7ANUGykGRcM70dWpTjpUf+GYSEVjWZCEJqtN2EXEiFopzYlC rGZ/PQrXbBJWExkUPRD9p6UcKogrrBRXlm+qN9xXAwSAMw4xMZIqVkOLt78sEtuz3lO5 J3NIm2L8/c4pFqYlyboHIAV41qoOLH4bUbr6uolCAXG5MaibmTDjziL3xzCZMEXO+UAK W97lLyvLKyWlbcNZkGhzWM9vCbdErbNfY5QhvswFtUbXWD8JKjSpYMm04i30t4BB2JZ8 t63w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779987889; x=1780592689; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=MVvKmQSUVNcPGnpeO8ALn7LkyX+WnGR/CwcsH9fvnZM=; b=TR5JWQsGLMUvPZsxLMtqqGUSooQXZnwLrxKKb8Ep/anV3ZHYz6xPjNiP8GNEPU0TEG eIylkOuDEmVAHPUVGJoQLk6pswTzS3oADg8Xz+iJITcbknP7pDDRin/EuCViLbTQYU4z dq/VEtUNWwldVs7JO6cWKmkDaC/nR96qrv6b1s0dm9Ig6Z7W1CzpAjJJwJmUY5Uj4+Zs dDrTtNlTK81QLM6uY3ymynw4fBtSTrAqHhcnAiYc4TBclbGeLDA+h5qes88axBkqAxvg 6tW7GcknTtdPmvg2UoHOSjnHtov+MS1ayeNpDrxTp+F9yrbSpMV5VGCqCa9fRVcWBoPu KvWg== X-Forwarded-Encrypted: i=1; AFNElJ+rZz5WLxkiXQi1HfaQy2TmQCX7che4sfBek8ZIx3o4iY4l5rnrh3dK7fvhWzhqFMTkMRopdBkkzKrBPzw=@vger.kernel.org X-Gm-Message-State: AOJu0YzH0Jgsdw1WekxEF8AZfPNsXRdQNrWk88LcizUIf5zjRnqS1qKE VJVgpO+w4qcw67l5qZlCk3iUvHX4DybhBuOWRkM2zorIx4pOKsNxv+sm X-Gm-Gg: Acq92OE0vvvv6XZN3Z9YqyRHPRqiXA8RJx7wxdHcgcH2U28PWaJ2kuSO7w9V6hUKuF+ NcNjoTh/pjt4TZB058UMF8x2NVJx3jzcGhXaMJkieCIYadkLFLZtv53tzTY3AL2F1lxYwv5q1rl WPL/7hnF2ThizDbGvNJGVOrX5vGkmM74Miz1MopnixxrXJM4md6PbaD6kgb62ikU/pNd6DEBopv UTK/psnUnhDLASef2JNrshRyAm1FAyZWGyIFN6JZDnqucwrZVdvPd9AwEzd7YABL0QCa9g4kKtK hAye1+AZ8GqqwsWqvZRp+uabS39DKnqx5I0132IiUQUNfpg1bYk/Vc6mmyu+QG9Ku1jpqvqAvd5 ZDgfeTUsc0zaYqwiaExcDv64i+lVOjIgcnOcEnsHO6x9gE4R5B7zMQx4AzHbijFzNZ9KBwFeykY mRYDqvAeLodPoAY9kUU7Se5JfBKtt1QrEFrHi+SKly4SXSGD21BNdGLIlpwW3XyuOk X-Received: by 2002:a05:6214:419e:b0:8ac:ae66:8eb9 with SMTP id 6a1803df08f44-8cc7b5dbc35mr458058886d6.46.1779987888752; Thu, 28 May 2026 10:04:48 -0700 (PDT) Received: from smtpclient.apple ([104.39.165.68]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8cc812e657csm227722756d6.24.2026.05.28.10.04.48 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 28 May 2026 10:04:48 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: [BUG] KASAN: slab-use-after-free in siw_cm_work_handler From: Shuangpeng In-Reply-To: <94d830ba-a8ec-4505-84e0-947a930ccf0a@linux.dev> Date: Thu, 28 May 2026 13:04:37 -0400 Cc: jgg@ziepe.ca, leon@kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Message-Id: <143D58FD-E3E8-4B1D-B33B-D1117C38CB0A@gmail.com> References: <94d830ba-a8ec-4505-84e0-947a930ccf0a@linux.dev> To: Bernard Metzler X-Mailer: Apple Mail (2.3864.600.51.1.1) Thanks for the update. If there is anything else I can help with on my side, feel free to let = me know. Best, Shuangpeng > On May 28, 2026, at 06:02, Bernard Metzler = wrote: >=20 > On 28.05.2026 05:52, Shuangpeng wrote: >> Hi Kernel Maintainers, >> I hit the following KASAN report while testing current upstream = kernel: >> KASAN: slab-use-after-free in siw_cm_work_handler >> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) >> The reproducer, detailed document, and .config files are here: >> = https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce >> I=E2=80=99m happy to test debug patches or provide additional = information. >=20 > Thanks Shuangpeng, I will look at it next week. > I am currently travelling w/o access to any > development environment. >=20 > Thanks for reporting! > Bernard. >=20 >> Reported-by: Shuangpeng Bai >> [ 60.059964][ T817] = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> [ 60.060980][ T817] BUG: KASAN: slab-use-after-free in = siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 = drivers/infiniband/sw/siw/siw_cm.c:1075) >> [ 60.062008][ T817] Write of size 8 at addr ffff888170c8ac70 by = task kworker/u8:1/817 >> [ 60.063033][ T817] >> [ 60.063347][ T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX = + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 >> [ 60.063350][ T817] Workqueue: siw_cm_wq siw_cm_work_handler >> [ 60.063356][ T817] Call Trace: >> [ 60.063359][ T817] >> [ 60.063361][ T817] dump_stack_lvl (lib/dump_stack.c:94 = lib/dump_stack.c:120) >> [ 60.063369][ T817] print_report (mm/kasan/report.c:378 = mm/kasan/report.c:482) >> [ 60.063385][ T817] kasan_report (mm/kasan/report.c:595) >> [ 60.063399][ T817] siw_cm_work_handler = (drivers/infiniband/sw/siw/siw_cm.c:1053 = drivers/infiniband/sw/siw/siw_cm.c:1075) >> [ 60.063472][ T817] process_scheduled_works = (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >> [ 60.063477][ T817] worker_thread (kernel/workqueue.c:3478) >> [ 60.063484][ T817] kthread (kernel/kthread.c:436) >> [ 60.063495][ T817] ret_from_fork (arch/x86/kernel/process.c:158) >> [ 60.063511][ T817] ret_from_fork_asm = (arch/x86/entry/entry_64.S:245) >> [ 60.063515][ T817] >> [ 60.063516][ T817] >> [ 60.087529][ T817] Freed by task 817 on cpu 1 at 60.059899s: >> [ 60.088264][ T817] kasan_save_track (mm/kasan/common.c:57 = mm/kasan/common.c:78) >> [ 60.088821][ T817] kasan_save_free_info (mm/kasan/generic.c:584) >> [ 60.089385][ T817] __kasan_slab_free (mm/kasan/common.c:253 = mm/kasan/common.c:285) >> [ 60.089940][ T817] kfree (./include/linux/kasan.h:235 = mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) >> [ 60.090383][ T817] siw_cm_work_handler = (drivers/infiniband/sw/siw/siw_cm.c:141 = drivers/infiniband/sw/siw/siw_cm.c:1051 = drivers/infiniband/sw/siw/siw_cm.c:1075) >> [ 60.090979][ T817] process_scheduled_works = (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >> [ 60.091616][ T817] worker_thread (kernel/workqueue.c:3478) >> [ 60.092191][ T817] kthread (kernel/kthread.c:436) >> [ 60.092637][ T817] ret_from_fork (arch/x86/kernel/process.c:158) >> [ 60.093226][ T817] ret_from_fork_asm = (arch/x86/entry/entry_64.S:245) >> [ 60.093782][ T817] >> [ 60.094033][ T817] The buggy address belongs to the object at = ffff888170c8ac00 >> [ 60.094033][ T817] which belongs to the cache kmalloc-256 of = size 256 >> [ 60.095541][ T817] The buggy address is located 112 bytes inside = of >> [ 60.095541][ T817] freed 256-byte region [ffff888170c8ac00, = ffff888170c8ad00) >> Best, >> Shuangpeng >=20