* [BUG] KASAN: slab-use-after-free in siw_cm_work_handler
@ 2026-05-28 3:52 Shuangpeng
2026-05-28 10:02 ` Bernard Metzler
0 siblings, 1 reply; 3+ messages in thread
From: Shuangpeng @ 2026-05-28 3:52 UTC (permalink / raw)
To: bernard.metzler, jgg, leon; +Cc: linux-rdma, linux-kernel
Hi Kernel Maintainers,
I hit the following KASAN report while testing current upstream kernel:
KASAN: slab-use-after-free in siw_cm_work_handler
on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
The reproducer, detailed document, and .config files are here:
https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce
I’m happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 60.059964][ T817] ==================================================================
[ 60.060980][ T817] BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
[ 60.062008][ T817] Write of size 8 at addr ffff888170c8ac70 by task kworker/u8:1/817
[ 60.063033][ T817]
[ 60.063347][ T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 60.063350][ T817] Workqueue: siw_cm_wq siw_cm_work_handler
[ 60.063356][ T817] Call Trace:
[ 60.063359][ T817] <TASK>
[ 60.063361][ T817] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 60.063369][ T817] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 60.063385][ T817] kasan_report (mm/kasan/report.c:595)
[ 60.063399][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
[ 60.063472][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
[ 60.063477][ T817] worker_thread (kernel/workqueue.c:3478)
[ 60.063484][ T817] kthread (kernel/kthread.c:436)
[ 60.063495][ T817] ret_from_fork (arch/x86/kernel/process.c:158)
[ 60.063511][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 60.063515][ T817] </TASK>
[ 60.063516][ T817]
[ 60.087529][ T817] Freed by task 817 on cpu 1 at 60.059899s:
[ 60.088264][ T817] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 60.088821][ T817] kasan_save_free_info (mm/kasan/generic.c:584)
[ 60.089385][ T817] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 60.089940][ T817] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
[ 60.090383][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:141 drivers/infiniband/sw/siw/siw_cm.c:1051 drivers/infiniband/sw/siw/siw_cm.c:1075)
[ 60.090979][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
[ 60.091616][ T817] worker_thread (kernel/workqueue.c:3478)
[ 60.092191][ T817] kthread (kernel/kthread.c:436)
[ 60.092637][ T817] ret_from_fork (arch/x86/kernel/process.c:158)
[ 60.093226][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 60.093782][ T817]
[ 60.094033][ T817] The buggy address belongs to the object at ffff888170c8ac00
[ 60.094033][ T817] which belongs to the cache kmalloc-256 of size 256
[ 60.095541][ T817] The buggy address is located 112 bytes inside of
[ 60.095541][ T817] freed 256-byte region [ffff888170c8ac00, ffff888170c8ad00)
Best,
Shuangpeng
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in siw_cm_work_handler
2026-05-28 3:52 [BUG] KASAN: slab-use-after-free in siw_cm_work_handler Shuangpeng
@ 2026-05-28 10:02 ` Bernard Metzler
2026-05-28 17:04 ` Shuangpeng
0 siblings, 1 reply; 3+ messages in thread
From: Bernard Metzler @ 2026-05-28 10:02 UTC (permalink / raw)
To: Shuangpeng, jgg, leon; +Cc: linux-rdma, linux-kernel
On 28.05.2026 05:52, Shuangpeng wrote:
> Hi Kernel Maintainers,
>
> I hit the following KASAN report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in siw_cm_work_handler
>
> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
>
> The reproducer, detailed document, and .config files are here:
> https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce
>
> I’m happy to test debug patches or provide additional information.
>
Thanks Shuangpeng, I will look at it next week.
I am currently travelling w/o access to any
development environment.
Thanks for reporting!
Bernard.
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
>
>
>
> [ 60.059964][ T817] ==================================================================
> [ 60.060980][ T817] BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
> [ 60.062008][ T817] Write of size 8 at addr ffff888170c8ac70 by task kworker/u8:1/817
> [ 60.063033][ T817]
> [ 60.063347][ T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [ 60.063350][ T817] Workqueue: siw_cm_wq siw_cm_work_handler
> [ 60.063356][ T817] Call Trace:
> [ 60.063359][ T817] <TASK>
> [ 60.063361][ T817] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
> [ 60.063369][ T817] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
> [ 60.063385][ T817] kasan_report (mm/kasan/report.c:595)
> [ 60.063399][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
> [ 60.063472][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
> [ 60.063477][ T817] worker_thread (kernel/workqueue.c:3478)
> [ 60.063484][ T817] kthread (kernel/kthread.c:436)
> [ 60.063495][ T817] ret_from_fork (arch/x86/kernel/process.c:158)
> [ 60.063511][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> [ 60.063515][ T817] </TASK>
> [ 60.063516][ T817]
> [ 60.087529][ T817] Freed by task 817 on cpu 1 at 60.059899s:
> [ 60.088264][ T817] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
> [ 60.088821][ T817] kasan_save_free_info (mm/kasan/generic.c:584)
> [ 60.089385][ T817] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
> [ 60.089940][ T817] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
> [ 60.090383][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:141 drivers/infiniband/sw/siw/siw_cm.c:1051 drivers/infiniband/sw/siw/siw_cm.c:1075)
> [ 60.090979][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
> [ 60.091616][ T817] worker_thread (kernel/workqueue.c:3478)
> [ 60.092191][ T817] kthread (kernel/kthread.c:436)
> [ 60.092637][ T817] ret_from_fork (arch/x86/kernel/process.c:158)
> [ 60.093226][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> [ 60.093782][ T817]
> [ 60.094033][ T817] The buggy address belongs to the object at ffff888170c8ac00
> [ 60.094033][ T817] which belongs to the cache kmalloc-256 of size 256
> [ 60.095541][ T817] The buggy address is located 112 bytes inside of
> [ 60.095541][ T817] freed 256-byte region [ffff888170c8ac00, ffff888170c8ad00)
>
>
>
>
> Best,
> Shuangpeng
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in siw_cm_work_handler
2026-05-28 10:02 ` Bernard Metzler
@ 2026-05-28 17:04 ` Shuangpeng
0 siblings, 0 replies; 3+ messages in thread
From: Shuangpeng @ 2026-05-28 17:04 UTC (permalink / raw)
To: Bernard Metzler; +Cc: jgg, leon, linux-rdma, linux-kernel
Thanks for the update.
If there is anything else I can help with on my side, feel free to let me know.
Best,
Shuangpeng
> On May 28, 2026, at 06:02, Bernard Metzler <bernard.metzler@linux.dev> wrote:
>
> On 28.05.2026 05:52, Shuangpeng wrote:
>> Hi Kernel Maintainers,
>> I hit the following KASAN report while testing current upstream kernel:
>> KASAN: slab-use-after-free in siw_cm_work_handler
>> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
>> The reproducer, detailed document, and .config files are here:
>> https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce
>> I’m happy to test debug patches or provide additional information.
>
> Thanks Shuangpeng, I will look at it next week.
> I am currently travelling w/o access to any
> development environment.
>
> Thanks for reporting!
> Bernard.
>
>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
>> [ 60.059964][ T817] ==================================================================
>> [ 60.060980][ T817] BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
>> [ 60.062008][ T817] Write of size 8 at addr ffff888170c8ac70 by task kworker/u8:1/817
>> [ 60.063033][ T817]
>> [ 60.063347][ T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
>> [ 60.063350][ T817] Workqueue: siw_cm_wq siw_cm_work_handler
>> [ 60.063356][ T817] Call Trace:
>> [ 60.063359][ T817] <TASK>
>> [ 60.063361][ T817] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
>> [ 60.063369][ T817] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
>> [ 60.063385][ T817] kasan_report (mm/kasan/report.c:595)
>> [ 60.063399][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
>> [ 60.063472][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
>> [ 60.063477][ T817] worker_thread (kernel/workqueue.c:3478)
>> [ 60.063484][ T817] kthread (kernel/kthread.c:436)
>> [ 60.063495][ T817] ret_from_fork (arch/x86/kernel/process.c:158)
>> [ 60.063511][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>> [ 60.063515][ T817] </TASK>
>> [ 60.063516][ T817]
>> [ 60.087529][ T817] Freed by task 817 on cpu 1 at 60.059899s:
>> [ 60.088264][ T817] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
>> [ 60.088821][ T817] kasan_save_free_info (mm/kasan/generic.c:584)
>> [ 60.089385][ T817] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
>> [ 60.089940][ T817] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
>> [ 60.090383][ T817] siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:141 drivers/infiniband/sw/siw/siw_cm.c:1051 drivers/infiniband/sw/siw/siw_cm.c:1075)
>> [ 60.090979][ T817] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
>> [ 60.091616][ T817] worker_thread (kernel/workqueue.c:3478)
>> [ 60.092191][ T817] kthread (kernel/kthread.c:436)
>> [ 60.092637][ T817] ret_from_fork (arch/x86/kernel/process.c:158)
>> [ 60.093226][ T817] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>> [ 60.093782][ T817]
>> [ 60.094033][ T817] The buggy address belongs to the object at ffff888170c8ac00
>> [ 60.094033][ T817] which belongs to the cache kmalloc-256 of size 256
>> [ 60.095541][ T817] The buggy address is located 112 bytes inside of
>> [ 60.095541][ T817] freed 256-byte region [ffff888170c8ac00, ffff888170c8ad00)
>> Best,
>> Shuangpeng
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-28 17:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-28 3:52 [BUG] KASAN: slab-use-after-free in siw_cm_work_handler Shuangpeng
2026-05-28 10:02 ` Bernard Metzler
2026-05-28 17:04 ` Shuangpeng
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox