From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A33D03CB56A; Wed, 30 Sep 2026 19:18:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790795908; cv=none; b=AcDtCVmao21Hk2VPIbBLiz65wgRPSrnn+3hGJq4wTDmarMhD6kv+7okZsOAYw8FeJpcj7pQxymVri+9IleMtJ4XxQQXxnJazQPio6sgerQKvOGgeOAnc+MdAjxz9IzJW9zDtKKeLx0zGnyv/2IIbEUY9lmZUoF26T3C/dD0IuTQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790795908; c=relaxed/simple; bh=dBu13hNnSeQiEIW0TiptOD0JWrpfGT77KWT7EVlapfg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aTzfOLrVA9PhHkdo9ACnz0/LQF88jfc8+Er0q2wYgT8B7tMdzUTymo4ZBl4hLtL7h6EbiMHFyzeiodkRa2IRjotX6SPVjQEXbvo+GplPa+mnq5z8L99j2RdmL28U3xL6jn6I5cVmEj2hmN0cRpytArqGaR2M0ykPga+GOTSLSgw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cCNoyJJE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="cCNoyJJE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0EB21F000FF; Wed, 30 Sep 2026 19:18:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790795907; bh=dzvwxsPjUAj/pqjItwrQ5WbQh7IYNVrPa4nNJhzSaCo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cCNoyJJEHRsKAp5zWNoTMfffPuFssYPrVOPiSpKLoTIVPtQCCpB/ibv3HaZ0PYbfL 6Rn+KhBsd/GMulmDY2ti9jaBvdYa0jhesvPOmIwUoGfGL6Bl7UKIKA8BX2rHcg0nuf MEckr0OxiR9KrlMCFN+AHP+JipyYvUhfymbdUlmU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shuangpeng Bai , Guoqing Jiang , Bernard Metzler , Leon Romanovsky , Sasha Levin Subject: [PATCH 6.6 0727/1193] RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept Date: Wed, 30 Sep 2026 17:23:31 +0200 Message-ID: <20260930152450.405221682@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260930152434.301151190@linuxfoundation.org> References: <20260930152434.301151190@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guoqing Jiang [ Upstream commit 32cd87f54dd1070020e664ccb0312a9f0fea79b4 ] We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock is released before the error path cleanup. A concurrent ibv_modify_qp() transitioning the QP to ERROR can race in this window: siw_accept() ibv_modify_qp(ERROR) ---------------------- ---------------------- siw_qp_modify() fails up_write(&qp->state_lock) down_write(&qp->state_lock) nextstate_from_idle(): if (qp->cep) siw_cep_put(qp->cep) <- frees cep qp->cep = NULL goto error cep->qp = NULL <- UAF Clear qp->cep and drop the association reference taken by siw_cep_get(), all under the write lock held from the initial down_write(&qp->state_lock). Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free the cep before siw_accept() is done with it. Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Reported-by: Shuangpeng Bai Link: https://lore.kernel.org/linux-rdma/d6fbe475-a5c2-f975-99b0-a0bd6b6d10e8@linux.dev/T/#m5876c1ff2de8686a9a1173b8f1aa0ff5363a785c Signed-off-by: Guoqing Jiang Link: https://patch.msgid.link/20260827125553.12831-1-guoqing.jiang@linux.dev Acked-by: Bernard Metzler Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin --- drivers/infiniband/sw/siw/siw_cm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c index e5d04a060b228..3551824e371a6 100644 --- a/drivers/infiniband/sw/siw/siw_cm.c +++ b/drivers/infiniband/sw/siw/siw_cm.c @@ -1673,9 +1673,12 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params) SIW_QP_ATTR_STATE | SIW_QP_ATTR_LLP_HANDLE | SIW_QP_ATTR_ORD | SIW_QP_ATTR_IRD | SIW_QP_ATTR_MPA); + if (rv) { + qp->cep = NULL; + siw_cep_put(cep); + goto error_unlock; + } up_write(&qp->state_lock); - if (rv) - goto error; siw_dbg_cep(cep, "[QP %u]: send mpa reply, %d byte pdata\n", qp_id(qp), params->private_data_len); -- 2.53.0