From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f179.google.com (mail-qt1-f179.google.com [209.85.160.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5CD84304BB3 for ; Sun, 16 Aug 2026 06:16:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786860984; cv=none; b=M+faYl4zymfLO9z/jhsVQvFJXKnQTarxm5DNjcCO/zX9G9Vyu8U8AeO1XoBq5eOwhaJoqRC/U9qIU/EWrvPGC3lGVQ8yfihv9340PYgPyV80cGdJvjgMe8WnbU1aCGGvgWCyJU8yiHzHEOQXVsibxB/UObdV5RLDHyx76AAJM7U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786860984; c=relaxed/simple; bh=PwBAtWLTBQdOhYmMRvqHmuyod5fAKCsuGd/VPX/xwMY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ORLbNlRApENiDYmqrUzQrBsn+M5eELWlUGUzwMwNqVg7YoKBGu8D6Nod/H3LeqM9x2xbL1HICuV2e4Mn3xJCl9klPzgX4aaKv1VactMbNdUof1dz0CzeubusdTIS3cONrc9MwsziD56wBmoAedPe6Yzo1D08+0NR9WiJpMItio8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OKDfErwp; arc=none smtp.client-ip=209.85.160.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OKDfErwp" Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-51c0c45c580so14535441cf.0 for ; Sat, 15 Aug 2026 23:16:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786860982; x=1787465782; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Dx71Tj0Yh74N2KF4WkBSx6E9gWnoVmw5HGH3PfpwUbA=; b=OKDfErwpCvTgRHTuf+8/EpjXDLdgNZqDCXzjD5dMI8r54n2DmWx9Zuk77TlK85dgTP mUFKgNppp+YnOdTVvjo5xlwScL/eEdlsrGQPMn3j9bFjcQKZ7VI4XcAKVhzbA7FBV9Cx zwzT498CXUMpb/V41mjy6HSD8uBbFOnnZ2Eo4kwMNYgUy94scxQtJXYHphkZuXtbl7+v e/2zheg9s3mwHfddAbqwM5CRaT30tXeRY1bvLkHnmiAU593Fkd6Skw9d0LhZg2fUs+jl Q4YuPVZq4lZHYX4jkYmZzzisdmTdUuF7496vetmaQBOEePSHyVH7mgp7nMl98Cobq7st MZRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786860982; x=1787465782; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Dx71Tj0Yh74N2KF4WkBSx6E9gWnoVmw5HGH3PfpwUbA=; b=FcO12xnSXrGQBmMxnCOB0jXXjRr/seAWDTGqMM5tsWokS5OF2bHa0VwOtMHyGgdA84 u4yMFXWYNDvFOEkTs5ogGtRvS66b31nMNweh7fexu8yD44RnG1f4TXqW1559zs9FuI42 /ApInJgOSEsPiLJ0DHX1IiJSjW5yrW2C1Rz2ux0Rxzh6qHW3/STdQ68iDgdTzb1ouraJ WhlSg8MbLUxvEUx2CBvLUqvWGaeYxmljz4eWp0L6fIvurVpsCf6ziazotwZoVVjfZ+AC 6LOXdlaydB308GiAsuL1QAyoWOXSvg5vz3E60yK+IBnf1v06ZlHqMG/q71aHQfF9USff vVaQ== X-Forwarded-Encrypted: i=1; AHgh+RrUl44BF9ZzKxM+poyXAdx6IJqUbqQe8JVsmjuopWgoQKB0g9kCVRwrC8LnoIT+1V7sMov1XZ8jKRSa8qk=@vger.kernel.org X-Gm-Message-State: AOJu0YzlzYiiW5c/Q0EegmNEJbZivbG72iNlviNl/S0mE3tI98WK88b7 IxNPjdyvqW5xVlh96ytPDuu837BVAi1Fw8d+k+rOLZAJVn6QDIVv0XwA X-Gm-Gg: AR+sD11ohY7+BRMYy69PUYgycbYs+be5YTzUxKZ1huweELXez9VxK67uAjGwmfjnKyg zuyvHFK/ctXQpEhNprFRIxdZUPyGoHXmSWhTYTkuUxyOXubm0lEkYmpLYZgvQUDrjWYkDHibgH3 ht4wF283B1xBXcvIl9ps1gL+X+0tc5znd3SYdt8qKiA4tVNpTI/dMLBp1tiuOGTx8PXP20ynQBX TjnLqeFIWQa4TWdE0B+zWBkQ5np4Rk0eCpPQqVuXhVY1g/bJF7aFvNRpVfE2MkUxJ4c/YLWIEkT s9Aa3Ke/UV8InPOw4b95e4bRwh/0Aq/6dz1gXJsiYmTikOWD1NKTF6Si58wl9ZMPDsgjiqqimwO LgUqzTZ4cmVhfyidBhkYMgkdm//+wnby9Ji96USTP3VoAy1XvzXrv67Mf27XwxP3BLofe2vLHGC CMdaP2Ubu2yDVGun3NpxlslQInvMjnFCV2UPjmdvWCuCJpQMzFSSdZmByHmeR6MDyqNyAekYUXO fCRgVIBPssvr8uiIQ== X-Received: by 2002:ac8:7fd4:0:b0:519:8b76:2ce0 with SMTP id d75a77b69052e-52d85538e0emr189855501cf.37.1786860982216; Sat, 15 Aug 2026 23:16:22 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-52d84043241sm54126611cf.16.2026.08.15.23.16.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 15 Aug 2026 23:16:21 -0700 (PDT) From: Shuangpeng Bai To: bernard.metzler@linux.dev, jgg@ziepe.ca, leon@kernel.org Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Shuangpeng Bai Subject: [PATCH] RDMA/siw: Fix CEP reference race in siw_accept() Date: Sun, 16 Aug 2026 02:13:53 -0400 Message-ID: <20260816061353.4059242-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit siw_accept() associates a CEP with the selected QP while holding qp->state_lock. If the transition to RTS fails, the error path releases the lock before detaching that association. The cleanup drops the QP association reference before clearing qp->cep. A concurrent QP destroy can acquire qp->state_lock in between, observe the stale pointer, and drop the same association reference again. This can free the CEP before siw_accept() releases its remaining reference, causing a use-after-free. Serialize the error-side detachment with qp->state_lock and clear qp->cep before dropping the association reference. This ensures that either the accept cleanup or QP teardown removes the association, but not both. This is a follow-up to commit a93949718259 ("RDMA/siw: Fix use-after-free in siw_accept()") and addresses a separate race in the same error path. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Link: https://patch.msgid.link/20260801213632.1086548-1-shuangpeng.kernel@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- drivers/infiniband/sw/siw/siw_cm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c index 0245b25e7271..da1b953f3fa3 100644 --- a/drivers/infiniband/sw/siw/siw_cm.c +++ b/drivers/infiniband/sw/siw/siw_cm.c @@ -1751,11 +1751,13 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params) cep->state = SIW_EPSTATE_CLOSED; siw_free_cm_id(cep); + down_write(&qp->state_lock); if (qp->cep == cep) { - siw_cep_put(cep); qp->cep = NULL; + siw_cep_put(cep); } cep->qp = NULL; + up_write(&qp->state_lock); siw_qp_put(qp); free_cep: siw_cep_set_free_and_put(cep); base-commit: a9394971825933074032794a5feee5211509c774 -- 2.43.0