From: Bernard Metzler <bernard.metzler@linux.dev>
To: Leon Romanovsky <leon@kernel.org>, Wentao Liang <vulab@iscas.ac.cn>
Cc: jgg@ziepe.ca, linux-kernel@vger.kernel.org,
linux-rdma@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH 7/7] RDMA/siw: Fix qp use-after-free in siw_get_base_qp()
Date: Wed, 23 Sep 2026 13:37:38 +0200 [thread overview]
Message-ID: <16b70ab0-bbb5-415a-ae1b-b68276f8046a@linux.dev> (raw)
In-Reply-To: <179015250789.3394760.13528866578642274394.b4-ty@kernel.org>
On 23.09.2026 10:35, Leon Romanovsky wrote:
>
> On Wed, 16 Sep 2026 18:44:00 +0000, Wentao Liang wrote:
>> The reference taken by siw_qp_id2obj() is dropped before the address
>> of the embedded ib_qp is taken from the QP. If that reference was
>> the last one the QP is freed and the pointer returned to the iwarp
>> core is dangling; the core only pins the QP with iw_add_ref() after
>> the call has returned.
>>
>> Copy the pointer while the reference is still held.
>>
>> [...]
>
> Applied, thanks!
>
> [7/7] RDMA/siw: Fix qp use-after-free in siw_get_base_qp()
> https://git.kernel.org/rdma/rdma/c/ef15197f81ffed
>
> Best regards,
excellent, thanks.
prev parent reply other threads:[~2026-09-23 11:37 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-16 18:44 [PATCH 7/7] RDMA/siw: Fix qp use-after-free in siw_get_base_qp() Wentao Liang
2026-09-23 8:35 ` Leon Romanovsky
2026-09-23 11:37 ` Bernard Metzler [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=16b70ab0-bbb5-415a-ae1b-b68276f8046a@linux.dev \
--to=bernard.metzler@linux.dev \
--cc=jgg@ziepe.ca \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vulab@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.