Re: [PATCH] RDMA/siw: Fix CEP reference race in siw_accept()

[Bernard Metzler <bernard.metzler@linux.dev>]

On 16.08.2026 08:13, Shuangpeng Bai wrote:
> siw_accept() associates a CEP with the selected QP while holding
> qp->state_lock. If the transition to RTS fails, the error path releases
> the lock before detaching that association.
> 
> The cleanup drops the QP association reference before clearing qp->cep.
> A concurrent QP destroy can acquire qp->state_lock in between, observe
> the stale pointer, and drop the same association reference again. This
> can free the CEP before siw_accept() releases its remaining reference,
> causing a use-after-free.

Do we have a stack trace for that use-after-free?>
> Serialize the error-side detachment with qp->state_lock and clear qp->cep
> before dropping the association reference. This ensures that either the
> accept cleanup or QP teardown removes the association, but not both.
> 
> This is a follow-up to commit a93949718259 ("RDMA/siw: Fix
> use-after-free in siw_accept()") and addresses a separate race in the
> same error path.
> 
> Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
> Link: https://patch.msgid.link/20260801213632.1086548-1-shuangpeng.kernel@gmail.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> ---
>   drivers/infiniband/sw/siw/siw_cm.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
> index 0245b25e7271..da1b953f3fa3 100644
> --- a/drivers/infiniband/sw/siw/siw_cm.c
> +++ b/drivers/infiniband/sw/siw/siw_cm.c
> @@ -1751,11 +1751,13 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
>   	cep->state = SIW_EPSTATE_CLOSED;
>   
>   	siw_free_cm_id(cep);

What can destroy the QP at this point?
An appication QP destroy shall be serialized with this
accept call by the RDMA core.

A concurrent connection drop by peer side would affect
QP state, but is serialized at the cep using
siw_cep_set_inuse()/_free() I don't see other cases
which are not serialized...?
> +	down_write(&qp->state_lock);

>   	if (qp->cep == cep) {
> -		siw_cep_put(cep);
>   		qp->cep = NULL;
> +		siw_cep_put(cep);
>   	}
>   	cep->qp = NULL;
> +	up_write(&qp->state_lock);
>   	siw_qp_put(qp);
>   free_cep:
>   	siw_cep_set_free_and_put(cep);
> 
> base-commit: a9394971825933074032794a5feee5211509c774