From: Deep Shah <deepshah146@gmail.com>
To: Bernard Metzler <bernard.metzler@linux.dev>
Cc: Jason Gunthorpe <jgg@ziepe.ca>, Leon Romanovsky <leon@kernel.org>,
linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org,
Deep Shah <deepshah146@gmail.com>,
stable@vger.kernel.org
Subject: [PATCH rdma-rc] RDMA/siw: Fix use-after-free in siw_mem_id2obj()
Date: Mon, 2 Nov 2026 06:44:37 +0000 [thread overview]
Message-ID: <20261102064437.23976-1-deepshah146@gmail.com> (raw)
siw_mem_id2obj() finds a siw_mem with xa_load() under rcu_read_lock()
and then takes a reference with kref_get_unless_zero(). This is only
safe if the object stays allocated until RCU readers are done with it.
siw_free_mem() frees it with kfree() as soon as the last reference is
dropped, so a lookup that races with the final put reads freed memory.
This happens when an MR is deregistered while an incoming RDMA WRITE
looks up its STag:
BUG: KASAN: slab-use-after-free in siw_mem_id2obj+0xe5/0x310
Read of size 4 at addr ff110001042aed88 by task repro-rcu2/90
Call Trace:
<IRQ>
siw_mem_id2obj+0xe5/0x310
siw_proc_write+0x282/0x430
siw_tcp_rx_data+0x12e/0xbf0
__tcp_read_sock+0x12c/0x440
siw_qp_llp_data_ready+0x147/0x260
Allocated by task 89:
siw_mr_add_mem+0xb2/0x2a0
siw_reg_user_mr+0x19f/0x380
ib_uverbs_reg_mr+0x2a7/0x4c0
Freed by task 89:
kfree+0x301/0x530
siw_dereg_mr+0x31/0x50
ib_dereg_mr_user+0xb9/0x200
Free siw_mem with kfree_rcu(). A lookup that loses the race then sees
a zero refcount and fails. The umem or PBL is still released at the
last put, since a failed lookup never touches it.
Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
Cc: stable@vger.kernel.org
Signed-off-by: Deep Shah <deepshah146@gmail.com>
---
drivers/infiniband/sw/siw/siw.h | 1 +
drivers/infiniband/sw/siw/siw_mem.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h
index dbc998248b1e..4ec9c2ac75e7 100644
--- a/drivers/infiniband/sw/siw/siw.h
+++ b/drivers/infiniband/sw/siw/siw.h
@@ -157,6 +157,7 @@ struct siw_mem {
void *mem_obj;
};
struct ib_pd *pd;
+ struct rcu_head rcu;
};
struct siw_mr {
diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
index 2a08817d3cce..be70dc9c8f81 100644
--- a/drivers/infiniband/sw/siw/siw_mem.c
+++ b/drivers/infiniband/sw/siw/siw_mem.c
@@ -115,7 +115,7 @@ void siw_free_mem(struct kref *ref)
else
kfree(mem->pbl);
}
- kfree(mem);
+ kfree_rcu(mem, rcu);
}
/*
reply other threads:[~2026-11-02 6:44 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261102064437.23976-1-deepshah146@gmail.com \
--to=deepshah146@gmail.com \
--cc=bernard.metzler@linux.dev \
--cc=jgg@ziepe.ca \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®