Re: [PATCH rdma-rc] RDMA/siw: Fix use-after-free in siw_mem_id2obj()

[sashiko-bot@kernel.org]

> siw_mem_id2obj() finds a siw_mem with xa_load() under rcu_read_lock()
> and then takes a reference with kref_get_unless_zero(). This is only
> safe if the object stays allocated until RCU readers are done with it.
> siw_free_mem() frees it with kfree() as soon as the last reference is
> dropped, so a lookup that races with the final put reads freed memory.
> 
> This happens when an MR is deregistered while an incoming RDMA WRITE
> looks up its STag:
> 
>   BUG: KASAN: slab-use-after-free in siw_mem_id2obj+0xe5/0x310
>   Read of size 4 at addr ff110001042aed88 by task repro-rcu2/90
>   Call Trace:
>    <IRQ>
>    siw_mem_id2obj+0xe5/0x310
>    siw_proc_write+0x282/0x430
> [ ... ]
> last put, since a failed lookup never touches it.
> 
> Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Deep Shah <deepshah146@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102064437.23976-1-deepshah146@gmail.com?part=1