[PATCH] RDMA/siw: Fix use-after-free in siw_accept()

[PATCH] RDMA/siw: Fix use-after-free in siw_accept()

[Shuangpeng Bai]

siw_accept() looks up the QP supplied by userspace. If that QP is
already in RTS, the function jumps to error cleanup before associating
the incoming CEP with it.

The cleanup tests whether qp->cep is non-NULL and assumes the current
call installed the association. However, qp->cep can point to the CEP
of an existing connection. The cleanup then drops a reference from the
incoming cep, not qp->cep. Once the incoming endpoint loses its
remaining references, this can free it before the subsequent cep->qp
store, causing a use-after-free. It also clears the existing QP
association.

Only release the association reference when qp->cep is the incoming
CEP. This preserves an existing association and avoids accessing the
freed endpoint.

Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/infiniband/sw/siw/siw_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 87c79527ac09..0245b25e7271 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1751,7 +1751,7 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
 	cep->state = SIW_EPSTATE_CLOSED;
 
 	siw_free_cm_id(cep);
-	if (qp->cep) {
+	if (qp->cep == cep) {
 		siw_cep_put(cep);
 		qp->cep = NULL;
 	}
-- 
2.43.0

Re: [PATCH] RDMA/siw: Fix use-after-free in siw_accept()

[Leon Romanovsky]

On Sat, 01 Aug 2026 17:36:32 -0400, Shuangpeng Bai wrote:
> siw_accept() looks up the QP supplied by userspace. If that QP is
> already in RTS, the function jumps to error cleanup before associating
> the incoming CEP with it.
> 
> The cleanup tests whether qp->cep is non-NULL and assumes the current
> call installed the association. However, qp->cep can point to the CEP
> of an existing connection. The cleanup then drops a reference from the
> incoming cep, not qp->cep. Once the incoming endpoint loses its
> remaining references, this can free it before the subsequent cep->qp
> store, causing a use-after-free. It also clears the existing QP
> association.
> 
> [...]

Applied, thanks!

[1/1] RDMA/siw: Fix use-after-free in siw_accept()
      https://git.kernel.org/rdma/rdma/c/a9394971825933

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>

Re: [PATCH] RDMA/siw: Fix use-after-free in siw_accept()

[Bernard Metzler]

On 01.08.2026 23:36, Shuangpeng Bai wrote:

Sorry I was away for 3 weeks and can review only now.

> siw_accept() looks up the QP supplied by userspace. If that QP is
> already in RTS, the function jumps to error cleanup before associating
> the incoming CEP with it.
> 
We test against any QP state other than expected
SIW_EPSTATE_RECVD_MPAREQ. The QP should never be in RTS here, since
it moves to RTS only after the user issued this accept we are in
and the RDMA CM core code makes sure a user does that only one time
per QP.
We typically end up in that error path, if the user spent to much time
in a new connection indication/accept path, while the peer already
closed that half open connection. So I don't follow that comment above.

Were you able to force such state mismatch?


> The cleanup tests whether qp->cep is non-NULL and assumes the current
> call installed the association. However, qp->cep can point to the CEP
> of an existing connection. The cleanup then drops a reference from the

Can that happen? QP numbers should be unique, maintained by
xa_alloc()/xa_erase(). A cep cannot be transferred among QP's.

> incoming cep, not qp->cep. Once the incoming endpoint loses its
> remaining references, this can free it before the subsequent cep->qp
> store, causing a use-after-free. It also clears the existing QP
> association.
> 
> Only release the association reference when qp->cep is the incoming
> CEP. This preserves an existing association and avoids accessing the
> freed endpoint.
> 
> Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> ---
>   drivers/infiniband/sw/siw/siw_cm.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
> index 87c79527ac09..0245b25e7271 100644
> --- a/drivers/infiniband/sw/siw/siw_cm.c
> +++ b/drivers/infiniband/sw/siw/siw_cm.c
> @@ -1751,7 +1751,7 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
>   	cep->state = SIW_EPSTATE_CLOSED;
>   
>   	siw_free_cm_id(cep);
> -	if (qp->cep) {
> +	if (qp->cep == cep) {

Is it really possible we have (qp->cep != cep)?
Were you able to create such situation?

Did you run into use_after_free?

Thanks very much!
Bernard.>   		siw_cep_put(cep);
>   		qp->cep = NULL;
>   	}