[PATCH] RDMA/siw: Ignore peer close events on listening endpoints

[PATCH] RDMA/siw: Ignore peer close events on listening endpoints

[Jaeyeong Lee]

A TCP child socket inherits the listener callbacks and sk_user_data before
kernel_accept() associates it with a new connection endpoint. If the peer
closes during this window, siw_cm_llp_state_change() queues a PEER_CLOSE
work item against the listening endpoint.

The worker releases that endpoint without removing it from the listener
list. A later listener teardown then walks the dangling entry, causing a
use-after-free in siw_destroy_listen().

With a listener backlog of at least two, an unauthenticated TCP peer can
reach this path by resetting a new connection before the accept worker
runs.

Ignore close notifications while the endpoint is still listening. Once
the child is accepted, its sk_user_data points to the new endpoint and
close notifications continue through the normal path.

Static analysis identified the issue. It reproduced twice on Linux
7.4-rc1 with SIW over loopback in QEMU. KASAN reported the endpoint
allocated by siw_create_listen(), freed by siw_cm_work_handler(), and
reused by siw_destroy_listen(). The same reproducer completed without
KASAN or lockdep reports after this change on one- and two-CPU guests.

Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Cc: stable@vger.kernel.org
Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
---
 drivers/infiniband/sw/siw/siw_cm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index ed49818793dde..518f09a2d37cf 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1361,6 +1361,8 @@ static void siw_cm_llp_state_change(struct sock *sk)
 
 	case TCP_CLOSE:
 	case TCP_CLOSE_WAIT:
+		if (cep->state == SIW_EPSTATE_LISTENING)
+			break;
 		if (cep->qp)
 			cep->qp->tx_ctx.tx_suspend = 1;
 		siw_cm_queue_work(cep, SIW_CM_WORK_PEER_CLOSE);
-- 
2.43.0

Re: [PATCH] RDMA/siw: Ignore peer close events on listening endpoints

[Leon Romanovsky]

On Wed, Nov 04, 2026 at 08:50:40AM +0000, Jaeyeong Lee wrote:
> A TCP child socket inherits the listener callbacks and sk_user_data before
> kernel_accept() associates it with a new connection endpoint. If the peer
> closes during this window, siw_cm_llp_state_change() queues a PEER_CLOSE
> work item against the listening endpoint.
> 
> The worker releases that endpoint without removing it from the listener
> list. A later listener teardown then walks the dangling entry, causing a
> use-after-free in siw_destroy_listen().
> 
> With a listener backlog of at least two, an unauthenticated TCP peer can
> reach this path by resetting a new connection before the accept worker
> runs.
> 
> Ignore close notifications while the endpoint is still listening. Once
> the child is accepted, its sk_user_data points to the new endpoint and
> close notifications continue through the normal path.
> 
> Static analysis identified the issue. It reproduced twice on Linux
> 7.4-rc1 with SIW over loopback in QEMU. KASAN reported the endpoint
> allocated by siw_create_listen(), freed by siw_cm_work_handler(), and
> reused by siw_destroy_listen(). The same reproducer completed without
> KASAN or lockdep reports after this change on one- and two-CPU guests.

Please add full dmesg stack trace to the commit message and resubmit.

Thanks

> 
> Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
> ---
>  drivers/infiniband/sw/siw/siw_cm.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
> index ed49818793dde..518f09a2d37cf 100644
> --- a/drivers/infiniband/sw/siw/siw_cm.c
> +++ b/drivers/infiniband/sw/siw/siw_cm.c
> @@ -1361,6 +1361,8 @@ static void siw_cm_llp_state_change(struct sock *sk)
>  
>  	case TCP_CLOSE:
>  	case TCP_CLOSE_WAIT:
> +		if (cep->state == SIW_EPSTATE_LISTENING)
> +			break;
>  		if (cep->qp)
>  			cep->qp->tx_ctx.tx_suspend = 1;
>  		siw_cm_queue_work(cep, SIW_CM_WORK_PEER_CLOSE);
> -- 
> 2.43.0
> 
>