From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
To: Jason Gunthorpe <jgg@ziepe.ca>, Leon Romanovsky <leon@kernel.org>,
luoqing <luoqing@kylinos.cn>, Florian Westphal <fw@strlen.de>
Cc: Shuangpeng Bai <shuangpeng.kernel@gmail.com>,
linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] RDMA/core: slab-use-after-free in iwpm_mapping_error_cb
Date: Thu, 5 Nov 2026 18:36:39 -0500 [thread overview]
Message-ID: <20261105233640.1667884-1-shuangpeng.kernel@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in _raw_spin_lock_irqsave
This report is in the IWPM request path in
drivers/infiniband/core/iwpm_msg.c, reached through an SIW RDMA-CM listen.
on commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d (2026-11-03, 7.4.0-rc1)
To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds delays and print statements.
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/14982f04cdb92f49d184d4a557a7f645
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 185.163150] ==================================================================
[ 185.163167] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:1300 ./include/asm-generic/qspinlock.h:112 ./include/linux/spinlock.h:188 ./include/linux/spinlock_api_smp.h:156 kernel/locking/spinlock.c:181)
[ 185.163192] Write of size 4 at addr ffff8881105178a8 by task iwpm_uaf_repro/326
[ 185.163202]
[ 185.163224] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 185.163231] Call Trace:
[ 185.163240] <TASK>
[ 185.163246] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 185.163262] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 185.163290] kasan_report (mm/kasan/report.c:595)
[ 185.163327] _raw_spin_lock_irqsave (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:1300 ./include/asm-generic/qspinlock.h:112 ./include/linux/spinlock.h:188 ./include/linux/spinlock_api_smp.h:156 kernel/locking/spinlock.c:181)
[ 185.163365] up (kernel/locking/semaphore.c:225)
[ 185.163399] iwpm_mapping_error_cb (drivers/infiniband/core/iwpm_msg.c:830)
[ 185.163424] netlink_dump (net/netlink/af_netlink.c:2359)
[ 185.163478] __netlink_dump_start (net/netlink/af_netlink.c:2474)
[ 185.163490] rdma_nl_rcv (./include/linux/netlink.h:341 drivers/infiniband/core/netlink.c:190 drivers/infiniband/core/netlink.c:239 drivers/infiniband/core/netlink.c:259)
[ 185.163565] netlink_unicast (net/netlink/af_netlink.c:1335 net/netlink/af_netlink.c:1361)
[ 185.163578] netlink_sendmsg (net/netlink/af_netlink.c:1920)
[ 185.163625] __sock_sendmsg (net/socket.c:800 net/socket.c:818)
[ 185.163634] ____sys_sendmsg (net/socket.c:2715)
[ 185.163675] ___sys_sendmsg (net/socket.c:2769)
[ 185.163731] __x64_sys_sendmsg (net/socket.c:2801 net/socket.c:2806 net/socket.c:2804 net/socket.c:2804)
[ 185.163784] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 185.163795] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 185.163878] RIP: 0033:0x7f3882776e4d
[ 185.163896] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48
All code
========
0: 28 89 54 24 1c 48 sub %cl,0x481c2454(%rcx)
6: 89 74 24 10 mov %esi,0x10(%rsp)
a: 89 7c 24 08 mov %edi,0x8(%rsp)
e: e8 ca ee ff ff call 0xffffffffffffeedd
13: 8b 54 24 1c mov 0x1c(%rsp),%edx
17: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
1c: 41 89 c0 mov %eax,%r8d
1f: 8b 7c 24 08 mov 0x8(%rsp),%edi
23: b8 2e 00 00 00 mov $0x2e,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 33 ja 0x65
32: 44 89 c7 mov %r8d,%edi
35: 48 89 44 24 08 mov %rax,0x8(%rsp)
3a: e8 fe ee ff ff call 0xffffffffffffef3d
3f: 48 rex.W
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 33 ja 0x3b
8: 44 89 c7 mov %r8d,%edi
b: 48 89 44 24 08 mov %rax,0x8(%rsp)
10: e8 fe ee ff ff call 0xffffffffffffef13
15: 48 rex.W
[ 185.163909] RSP: 002b:00007f3881d8a620 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
[ 185.163932] RAX: ffffffffffffffda RBX: 00007f3881d8a688 RCX: 00007f3882776e4d
[ 185.163945] RDX: 0000000000000000 RSI: 00007f3881d8a680 RDI: 0000000000000004
[ 185.163967] RBP: 00007f3881d8a6c0 R08: 0000000000000000 R09: 00007f3881d8b700
[ 185.163978] R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000000b3
[ 185.163988] R13: 00007ffd06f50dc0 R14: 00007f3881d8a664 R15: 00007f3881d8a680
[ 185.164008] </TASK>
[ 185.164014]
[ 185.164019] Allocated by task 324 on cpu 0 at 184.443436s:
[ 185.164033] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 185.164049] __kasan_kmalloc (mm/kasan/common.c:409 mm/kasan/common.c:426)
[ 185.164063] iwpm_get_nlmsg_request (./include/linux/slab.h:991 ./include/linux/slab.h:1312 drivers/infiniband/core/iwpm_util.c:313)
[ 185.164082] iwpm_add_mapping (drivers/infiniband/core/iwpm_msg.c:168)
[ 185.164094] iw_cm_map (drivers/infiniband/core/iwcm.c:537)
[ 185.164110] iw_cm_listen (drivers/infiniband/core/iwcm.c:580)
[ 185.164126] rdma_listen (drivers/infiniband/core/cma.c:2694 drivers/infiniband/core/cma.c:3988)
[ 185.164140] cma_listen_on_dev (drivers/infiniband/core/cma.c:2757)
[ 185.164157] cma_add_one (drivers/infiniband/core/cma.c:5445)
[ 185.164172] add_client_context (drivers/infiniband/core/device.c:755)
[ 185.164191] enable_device_and_get (drivers/infiniband/core/device.c:1375)
[ 185.164208] ib_register_device (drivers/infiniband/core/device.c:1503)
[ 185.164225] siw_newlink (drivers/infiniband/sw/siw/siw_main.c:71 drivers/infiniband/sw/siw/siw_main.c:433)
[ 185.164243] nldev_newlink (drivers/infiniband/core/nldev.c:1859)
[ 185.164267] netlink_unicast (net/netlink/af_netlink.c:1335 net/netlink/af_netlink.c:1361)
[ 185.164274] netlink_sendmsg (net/netlink/af_netlink.c:1920)
[ 185.164283] __sock_sendmsg (net/socket.c:800 net/socket.c:818)
[ 185.164290] ____sys_sendmsg (net/socket.c:2715)
[ 185.164299] ___sys_sendmsg (net/socket.c:2769)
[ 185.164309] __x64_sys_sendmsg (net/socket.c:2801 net/socket.c:2806 net/socket.c:2804 net/socket.c:2804)
[ 185.164318] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 185.164328] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 185.164336]
[ 185.164339] Freed by task 324 on cpu 0 at 184.947212s:
[ 185.164346] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 185.164354] kasan_save_free_info (mm/kasan/generic.c:584)
[ 185.164365] __kasan_slab_free (mm/kasan/common.c:264 mm/kasan/common.c:296)
[ 185.164374] kfree (./include/linux/kasan.h:235 mm/slub.c:2780 mm/slub.c:6630 mm/slub.c:6923)
[ 185.164382] iwpm_add_mapping (drivers/infiniband/core/iwpm_msg.c:217)
[ 185.164390] iw_cm_map (drivers/infiniband/core/iwcm.c:537)
[ 185.164400] iw_cm_listen (drivers/infiniband/core/iwcm.c:580)
[ 185.164410] rdma_listen (drivers/infiniband/core/cma.c:2694 drivers/infiniband/core/cma.c:3988)
[ 185.164418] cma_listen_on_dev (drivers/infiniband/core/cma.c:2757)
[ 185.164428] cma_add_one (drivers/infiniband/core/cma.c:5445)
[ 185.164438] add_client_context (drivers/infiniband/core/device.c:755)
[ 185.164449] enable_device_and_get (drivers/infiniband/core/device.c:1375)
[ 185.164459] ib_register_device (drivers/infiniband/core/device.c:1503)
[ 185.164470] siw_newlink (drivers/infiniband/sw/siw/siw_main.c:71 drivers/infiniband/sw/siw/siw_main.c:433)
[ 185.164481] nldev_newlink (drivers/infiniband/core/nldev.c:1859)
[ 185.164499] netlink_unicast (net/netlink/af_netlink.c:1335 net/netlink/af_netlink.c:1361)
[ 185.164505] netlink_sendmsg (net/netlink/af_netlink.c:1920)
[ 185.164513] __sock_sendmsg (net/socket.c:800 net/socket.c:818)
[ 185.164520] ____sys_sendmsg (net/socket.c:2715)
[ 185.164529] ___sys_sendmsg (net/socket.c:2769)
[ 185.164538] __x64_sys_sendmsg (net/socket.c:2801 net/socket.c:2806 net/socket.c:2804 net/socket.c:2804)
[ 185.164547] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 185.164556] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 185.164563]
[ 185.164566] The buggy address belongs to the object at ffff888110517880
[ 185.164566] which belongs to the cache kmalloc-64 of size 64
[ 185.164574] The buggy address is located 40 bytes inside of
[ 185.164574] freed 64-byte region [ffff888110517880, ffff8881105178c0)
[ 185.164583]
[ 185.164586] The buggy address belongs to the physical page:
Best,
Shuangpeng
reply other threads:[~2026-11-05 23:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261105233640.1667884-1-shuangpeng.kernel@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=fw@strlen.de \
--cc=jgg@ziepe.ca \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=luoqing@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®