From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f43.google.com (mail-qv1-f43.google.com [209.85.219.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED52E2DB7A3 for ; Thu, 28 May 2026 03:53:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779940382; cv=none; b=MuceQca/0+IpsCDogB2AaJdqEpVLu4EqilI2p0l6e3JAmLZXEqg0OvbOjOF85+RHu5B9K7E5S6IA5ttbK0InT0KMf9CRtxt/8KrcrdQC6qt7n6hzqrfG2/NfBbt2o+qMNvTVrKkl9PSff6YsOEjdaD85fEWVvMOkhgXopw2Dth0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779940382; c=relaxed/simple; bh=DQnvRbLLDRnhIZeLmXh7LWHMsIlHKRRVHVxc+4Rootw=; h=From:Content-Type:Mime-Version:Subject:Message-Id:Date:Cc:To; b=U6vzm0R4hasI0PsVxipC8EgyBE92ynbHUl982tvKQJWOXBLZS4oyYgvIHo479qWATco6Z5VxuIP6Nif6icOOvm+CLvwWNDF5BO5of/u6kgKOGxGsyZNXrruRg0VfulUI1sx9IZbRhIfT87mz5jw75pCXksJPF5JdQ8x1BTKgp/A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VXHWpt97; arc=none smtp.client-ip=209.85.219.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VXHWpt97" Received: by mail-qv1-f43.google.com with SMTP id 6a1803df08f44-8ca12973e15so165143936d6.1 for ; Wed, 27 May 2026 20:53:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779940380; x=1780545180; darn=vger.kernel.org; h=to:cc:date:message-id:subject:mime-version :content-transfer-encoding:from:from:to:cc:subject:date:message-id :reply-to; bh=8dMrYjvINrkHP2I7aJF9Y7W20M5jqPVJtuCbsMxY9Mo=; b=VXHWpt97MiRkk4nOGl8At+ayXjNXgNBKpzoAzlJEgedS7rI/qTbHty1iN3eE8fU9wC huijaeAFnPSnsA3GyeCubRye0swlol+OxeTKg0hb/4zUp0joKnp/mhq+XWtgIkNEPWZg 997Om5Iv8kfYsymcoJLGybX/W6ef5XHHmyWa5bKN0iP8EaEsBHb1sUbiH0DmxcgelfSY MkUTJLFzBejAf219U7DuB7o0/uT9hNe1RfZKriPCGmtrTc/sDwOU3ZlJF75z2W2ar2kI czgVDxdIxhzXMBSZkZghqcdilDRs8Z27TNeUAlJ4LWaQTjNPPVAMeg+NWBH0eXCkE86V tRMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779940380; x=1780545180; h=to:cc:date:message-id:subject:mime-version :content-transfer-encoding:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=8dMrYjvINrkHP2I7aJF9Y7W20M5jqPVJtuCbsMxY9Mo=; b=YNdeCpBJU/rtp8jxtM1jWVU7Dgs1N8JXEm8SqingIpT/5WpO1pvcAlkc/OdA19E4De s+SCX84NvuG/hXH6YWfRZZlVe2OshU39dz/XIQ87WiTSPS09ZfOuqYp9IlcKqBT60zZi 8V+aRVRoPDgwActd58N4wBd7uwdOEKFIHzCqQmMuqTZaynL/OwjabNxjKhqxLy6XYZz2 d3Jat4T9jK+PW6Jn7+xfDOwQZp/Xof5tmP1+VwQEpl3SNmDfFo8wi13/Hd9gS/zBxyU8 TBMz2gzA480HFi0Ukdybri1NED4Q91vIJX6ynE00fr5x/GI9qX9Pb/MZF0U4ae1J39cl epNQ== X-Forwarded-Encrypted: i=1; AFNElJ9sh+KQ4aJMuYkT5NfygXFgGjTL+7WU5zOfYnnYEfs+CoNiZlwNwaXz072OyiW6O3cfxT/rsU+hgnaoy/8=@vger.kernel.org X-Gm-Message-State: AOJu0YwIQ+MILpNyYroHfMGfsJqEb8xVAQUasJq/vL85eJmeSGG66n2Q dA84TS215ON+ZqnXEBtitEdKC/559PVty5EM5cIHG4bf+xg20RjPvle4 X-Gm-Gg: Acq92OE5XZmRTPXfG39najhKhU3248Mqv7Od9RUUTegEUD0DRgMtK8MOd2NLBpB+va3 CLzAFmcM/P1lzjKQ6wT++9cjdgr1mSPl1DGhokXNOiCCpCJmqhA/30DnnOY4bsJBxuo8JEjjPxf rWwmJq2+v3ah4ZyYwgciX/SstAohGEfKR49URYMzgwnBhgPKQJ9yG4ppVKT0DwPTQjXqOov6qND 5vVMtofgJYFRVhqz2zKlfC+v/AerOCVNvZvklmF+vn9ftF/RyGDN8PSy6hS1ruD/82K0tgqsec9 n2Q90esgy3Tt6uzRYFwOvywa3SqNDTsW6cIZktC2zBJ+bNRPuMFH7MZxJQkZlYKO5lneqfCGU4R rv3fKvriY9Wbd/pf0svxreW1z4Ov21OGC2ZV0SXNeRFJFdTqCJVm+4YUemHEGe8bha6CuSJhH4u DlX1Btfzztwyj7qOS/hmuSpVLnBZ6mX47dFqAvfXOG1h5MzMFF8hvajAZqAbNqX5J1fXSDLoOVJ Ko= X-Received: by 2002:a05:622a:134f:b0:50d:6b06:a453 with SMTP id d75a77b69052e-516d445ee68mr358347531cf.18.1779940379892; Wed, 27 May 2026 20:52:59 -0700 (PDT) Received: from smtpclient.apple ([2601:985:4601:5df0:e825:366f:655c:9bfd]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51706b081c7sm62479651cf.28.2026.05.27.20.52.59 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 May 2026 20:52:59 -0700 (PDT) From: Shuangpeng Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: [BUG] KASAN: slab-use-after-free in siw_cm_work_handler Message-Id: Date: Wed, 27 May 2026 23:52:48 -0400 Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org To: bernard.metzler@linux.dev, jgg@ziepe.ca, leon@kernel.org X-Mailer: Apple Mail (2.3864.600.51.1.1) Hi Kernel Maintainers, I hit the following KASAN report while testing current upstream kernel: KASAN: slab-use-after-free in siw_cm_work_handler on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The reproducer, detailed document, and .config files are here: https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce I=E2=80=99m happy to test debug patches or provide additional = information. Reported-by: Shuangpeng Bai [ 60.059964][ T817] = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 60.060980][ T817] BUG: KASAN: slab-use-after-free in = siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 = drivers/infiniband/sw/siw/siw_cm.c:1075) [ 60.062008][ T817] Write of size 8 at addr ffff888170c8ac70 by task = kworker/u8:1/817 [ 60.063033][ T817] [ 60.063347][ T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + = PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 60.063350][ T817] Workqueue: siw_cm_wq siw_cm_work_handler [ 60.063356][ T817] Call Trace: [ 60.063359][ T817] [ 60.063361][ T817] dump_stack_lvl (lib/dump_stack.c:94 = lib/dump_stack.c:120) [ 60.063369][ T817] print_report (mm/kasan/report.c:378 = mm/kasan/report.c:482) [ 60.063385][ T817] kasan_report (mm/kasan/report.c:595) [ 60.063399][ T817] siw_cm_work_handler = (drivers/infiniband/sw/siw/siw_cm.c:1053 = drivers/infiniband/sw/siw/siw_cm.c:1075) [ 60.063472][ T817] process_scheduled_works (kernel/workqueue.c:3314 = kernel/workqueue.c:3397) [ 60.063477][ T817] worker_thread (kernel/workqueue.c:3478) [ 60.063484][ T817] kthread (kernel/kthread.c:436) [ 60.063495][ T817] ret_from_fork (arch/x86/kernel/process.c:158) [ 60.063511][ T817] ret_from_fork_asm = (arch/x86/entry/entry_64.S:245) [ 60.063515][ T817] [ 60.063516][ T817] [ 60.087529][ T817] Freed by task 817 on cpu 1 at 60.059899s: [ 60.088264][ T817] kasan_save_track (mm/kasan/common.c:57 = mm/kasan/common.c:78) [ 60.088821][ T817] kasan_save_free_info (mm/kasan/generic.c:584) [ 60.089385][ T817] __kasan_slab_free (mm/kasan/common.c:253 = mm/kasan/common.c:285) [ 60.089940][ T817] kfree (./include/linux/kasan.h:235 = mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) [ 60.090383][ T817] siw_cm_work_handler = (drivers/infiniband/sw/siw/siw_cm.c:141 = drivers/infiniband/sw/siw/siw_cm.c:1051 = drivers/infiniband/sw/siw/siw_cm.c:1075) [ 60.090979][ T817] process_scheduled_works (kernel/workqueue.c:3314 = kernel/workqueue.c:3397) [ 60.091616][ T817] worker_thread (kernel/workqueue.c:3478) [ 60.092191][ T817] kthread (kernel/kthread.c:436) [ 60.092637][ T817] ret_from_fork (arch/x86/kernel/process.c:158) [ 60.093226][ T817] ret_from_fork_asm = (arch/x86/entry/entry_64.S:245) [ 60.093782][ T817] [ 60.094033][ T817] The buggy address belongs to the object at = ffff888170c8ac00 [ 60.094033][ T817] which belongs to the cache kmalloc-256 of size = 256 [ 60.095541][ T817] The buggy address is located 112 bytes inside of [ 60.095541][ T817] freed 256-byte region [ffff888170c8ac00, = ffff888170c8ad00) Best, Shuangpeng