From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E72247C0FA; Wed, 30 Sep 2026 15:49:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790783392; cv=none; b=Vwo53/vRuvIBPAsCU6XwsO5rJPl5Fqc7BGP6AmOUjki/z0RX6Qz9+kkQS0/CCiKk0MCCEU8w9ga/kuMJwrswxS54ftyjjkUDMJUUv1EoileV5D6MjTUKVEcgxDNzGs5/sY3SAX3b9BYXMNXFXylKGQBIDHZ3EseFlf1SMRL6UrM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790783392; c=relaxed/simple; bh=+/OSipnw1wXPkUmaYP+ykWePW/MFEFxNEydsigZGAu0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KnKIc08G3ipBSnSKsBWKcDHdOnFcRvelMXQH29cpUXjyN+IbswxoHqFtUf3Q7RjFuC8nR3HpoPRhh2V4iilNhBY6qui8IlOX9iHfHe5xof09B2l+xF9+ZudSH7sIqdLYdrUPgiloxu+lw94EZ0Fr+bR24EquMq3MnBlpfQf643w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ztdoHQmN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ztdoHQmN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA58C1F00898; Wed, 30 Sep 2026 15:49:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790783387; bh=wqIX9iDY5mDIcligqCjRonRT7v5FWA310CFDX1y7m1k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ztdoHQmNrcx1MLYqaUfUJ2GiBLnOLpP3Imc24PyRI4poRLP1GqPbBFzZpKVOUAlDu uYuwmWJkkNvhGjxLA4v7l3rkmBI6hWRwUWXaynKwaZLbUrNDMd7kGyoevWy/ya7kff JzfQulanqttNLIwgr9CdaF/FEp6lY+5GMOo7Za7A= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shuangpeng Bai , Guoqing Jiang , Bernard Metzler , Leon Romanovsky , Sasha Levin Subject: [PATCH 5.10 354/595] RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept Date: Wed, 30 Sep 2026 17:24:07 +0200 Message-ID: <20260930152355.292511802@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260930152347.700140858@linuxfoundation.org> References: <20260930152347.700140858@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guoqing Jiang [ Upstream commit 32cd87f54dd1070020e664ccb0312a9f0fea79b4 ] We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window: siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Reported-by: Shuangpeng Bai Link: https://lore.kernel.org/linux-rdma/d6fbe475-a5c2-f975-99b0-a0bd6b6d10e8@linux.dev/T/#m5876c1ff2de8686a9a1173b8f1aa0ff5363a785c Signed-off-by: Guoqing Jiang Link: https://patch.msgid.link/20260827125553.12831-1-guoqing.jiang@linux.dev Acked-by: Bernard Metzler Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin --- drivers/infiniband/sw/siw/siw_cm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c index f17dbb9237df7..5e1b577d1c92c 100644 --- a/drivers/infiniband/sw/siw/siw_cm.c +++ b/drivers/infiniband/sw/siw/siw_cm.c @@ -1662,9 +1662,12 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params) SIW_QP_ATTR_STATE | SIW_QP_ATTR_LLP_HANDLE | SIW_QP_ATTR_ORD | SIW_QP_ATTR_IRD | SIW_QP_ATTR_MPA); + if (rv) { + qp->cep = NULL; + siw_cep_put(cep); + goto error_unlock; + } up_write(&qp->state_lock); - if (rv) - goto error; siw_dbg_cep(cep, "[QP %u]: send mpa reply, %d byte pdata\n", qp_id(qp), params->private_data_len); -- 2.53.0