[BUG] KASAN: slab-use-after-free in siw_cm_work_handler

[Shuangpeng <shuangpeng.kernel@gmail.com>]

Hi Kernel Maintainers,

I hit the following KASAN report while testing current upstream kernel:

KASAN: slab-use-after-free in siw_cm_work_handler

on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)

The reproducer, detailed document, and .config files are here:
https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce

I’m happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>



[   60.059964][  T817] ==================================================================
[   60.060980][  T817] BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
[   60.062008][  T817] Write of size 8 at addr ffff888170c8ac70 by task kworker/u8:1/817
[   60.063033][  T817]
[   60.063347][  T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   60.063350][  T817] Workqueue: siw_cm_wq siw_cm_work_handler
[   60.063356][  T817] Call Trace:
[   60.063359][  T817]  <TASK>
[   60.063361][  T817]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[   60.063369][  T817]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[   60.063385][  T817]  kasan_report (mm/kasan/report.c:595)
[   60.063399][  T817]  siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
[   60.063472][  T817]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
[   60.063477][  T817]  worker_thread (kernel/workqueue.c:3478)
[   60.063484][  T817]  kthread (kernel/kthread.c:436)
[   60.063495][  T817]  ret_from_fork (arch/x86/kernel/process.c:158)
[   60.063511][  T817]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[   60.063515][  T817]  </TASK>
[   60.063516][  T817]
[   60.087529][  T817] Freed by task 817 on cpu 1 at 60.059899s:
[   60.088264][  T817]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[   60.088821][  T817]  kasan_save_free_info (mm/kasan/generic.c:584)
[   60.089385][  T817]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[   60.089940][  T817]  kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
[   60.090383][  T817]  siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:141 drivers/infiniband/sw/siw/siw_cm.c:1051 drivers/infiniband/sw/siw/siw_cm.c:1075)
[   60.090979][  T817]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
[   60.091616][  T817]  worker_thread (kernel/workqueue.c:3478)
[   60.092191][  T817]  kthread (kernel/kthread.c:436)
[   60.092637][  T817]  ret_from_fork (arch/x86/kernel/process.c:158)
[   60.093226][  T817]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[   60.093782][  T817]
[   60.094033][  T817] The buggy address belongs to the object at ffff888170c8ac00
[   60.094033][  T817]  which belongs to the cache kmalloc-256 of size 256
[   60.095541][  T817] The buggy address is located 112 bytes inside of
[   60.095541][  T817]  freed 256-byte region [ffff888170c8ac00, ffff888170c8ad00)




Best,
Shuangpeng