[PATCH] RDMA/siw: Fix CEP reference race in siw_accept()

[PATCH] RDMA/siw: Fix CEP reference race in siw_accept()

[Shuangpeng Bai]

siw_accept() associates a CEP with the selected QP while holding
qp->state_lock. If the transition to RTS fails, the error path releases
the lock before detaching that association.

The cleanup drops the QP association reference before clearing qp->cep.
A concurrent QP destroy can acquire qp->state_lock in between, observe
the stale pointer, and drop the same association reference again. This
can free the CEP before siw_accept() releases its remaining reference,
causing a use-after-free.

Serialize the error-side detachment with qp->state_lock and clear qp->cep
before dropping the association reference. This ensures that either the
accept cleanup or QP teardown removes the association, but not both.

This is a follow-up to commit a93949718259 ("RDMA/siw: Fix
use-after-free in siw_accept()") and addresses a separate race in the
same error path.

Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Link: https://patch.msgid.link/20260801213632.1086548-1-shuangpeng.kernel@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/infiniband/sw/siw/siw_cm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 0245b25e7271..da1b953f3fa3 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1751,11 +1751,13 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
 	cep->state = SIW_EPSTATE_CLOSED;
 
 	siw_free_cm_id(cep);
+	down_write(&qp->state_lock);
 	if (qp->cep == cep) {
-		siw_cep_put(cep);
 		qp->cep = NULL;
+		siw_cep_put(cep);
 	}
 	cep->qp = NULL;
+	up_write(&qp->state_lock);
 	siw_qp_put(qp);
 free_cep:
 	siw_cep_set_free_and_put(cep);

base-commit: a9394971825933074032794a5feee5211509c774
-- 
2.43.0