From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-186.mta0.migadu.com (out-186.mta0.migadu.com [91.218.175.186]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08C8B2459C5 for ; Thu, 28 May 2026 10:02:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.186 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779962543; cv=none; b=JRpuGyG77IPrAttFTQJgRqHWKpADG6Csw7CluoGyCS5D5ShUythQWcLMGaffD3Mp6cXkPrySlL1Yi/yIyVMqfLZ4xgXfqB52qghkV+ZKwgBazDVNPkD0wYtMOLTn2g6LEgFXNGNfQBHjjnRKUU1pHApnHAOZQ29s5VqV+2mAN/M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779962543; c=relaxed/simple; bh=WC8bhNqhQI6ok+lYewjNkzGNaQrIf1SxGQJ3MGJi+5g=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=m0e0+aPPxG6hc4D5FG0DqKEHeYwkTn1EmiFN8NYBgIlYTnGp94H8j3uYv6p+6VWG0qR46fkNO8yZQrGt7O5U5pNaRpsZAGyh18yS4Av2ReVdLRg6waqmlA68XbBQB33hSdN7Vqee2PRJTpnXUbahyQyl26nZ61fu4vJNTcrt0Fo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=GbFiFNB8; arc=none smtp.client-ip=91.218.175.186 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="GbFiFNB8" Message-ID: <94d830ba-a8ec-4505-84e0-947a930ccf0a@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779962540; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oejTxN9lF8TU+UST/6qHxdWQ8Qa2Iqj1rEXdtZAOGxc=; b=GbFiFNB84PzamiMmdoTUGBp37rckKJqA7QiSwbnqos+obaFzLLxOyp364q13z8YYtgQLi/ aqB2Tjo7/GR7J3ut+9qyjhQ//c60DWZBFSFN2OD8G2Jr4dr1Kj+maJlofRyThuzgBKqq8H F3JY6DJyIXtRr55SM+Z3HCXDt6sS0HA= Date: Thu, 28 May 2026 12:02:14 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [BUG] KASAN: slab-use-after-free in siw_cm_work_handler To: Shuangpeng , jgg@ziepe.ca, leon@kernel.org Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org References: X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Bernard Metzler In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT On 28.05.2026 05:52, Shuangpeng wrote: > Hi Kernel Maintainers, > > I hit the following KASAN report while testing current upstream kernel: > > KASAN: slab-use-after-free in siw_cm_work_handler > > on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) > > The reproducer, detailed document, and .config files are here: > https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce > > I’m happy to test debug patches or provide additional information. > Thanks Shuangpeng, I will look at it next week. I am currently travelling w/o access to any development environment. Thanks for reporting! Bernard. > Reported-by: Shuangpeng Bai > > > > [ 60.059964][ T817] ================================================================== > [ 60.060980][ T817] BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075) > [ 60.062008][ T817] Write of size 8 at addr ffff888170c8ac70 by task kworker/u8:1/817 > [ 60.063033][ T817] > [ 60.063347][ T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 > [ 60.063350][ T817] Workqueue: siw_cm_wq siw_cm_work_handler > [ 60.063356][ T817] Call Trace: > [ 60.063359][ T817] > [ 60.063361][ T817] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) > [ 60.063369][ T817] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) > [ 60.063385][ T817] kasan_report (mm/kasan/report.c:595) > [ 60.063399][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075) > [ 60.063472][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) > [ 60.063477][ T817] worker_thread (kernel/workqueue.c:3478) > [ 60.063484][ T817] kthread (kernel/kthread.c:436) > [ 60.063495][ T817] ret_from_fork (arch/x86/kernel/process.c:158) > [ 60.063511][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) > [ 60.063515][ T817] > [ 60.063516][ T817] > [ 60.087529][ T817] Freed by task 817 on cpu 1 at 60.059899s: > [ 60.088264][ T817] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) > [ 60.088821][ T817] kasan_save_free_info (mm/kasan/generic.c:584) > [ 60.089385][ T817] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) > [ 60.089940][ T817] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) > [ 60.090383][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:141 drivers/infiniband/sw/siw/siw_cm.c:1051 drivers/infiniband/sw/siw/siw_cm.c:1075) > [ 60.090979][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) > [ 60.091616][ T817] worker_thread (kernel/workqueue.c:3478) > [ 60.092191][ T817] kthread (kernel/kthread.c:436) > [ 60.092637][ T817] ret_from_fork (arch/x86/kernel/process.c:158) > [ 60.093226][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) > [ 60.093782][ T817] > [ 60.094033][ T817] The buggy address belongs to the object at ffff888170c8ac00 > [ 60.094033][ T817] which belongs to the cache kmalloc-256 of size 256 > [ 60.095541][ T817] The buggy address is located 112 bytes inside of > [ 60.095541][ T817] freed 256-byte region [ffff888170c8ac00, ffff888170c8ad00) > > > > > Best, > Shuangpeng >