Re: [PATCH] RDMA/siw: Fix CEP use-after-free in siw_connect()

[Bernard Metzler <bernard.metzler@linux.dev>]

On 16.08.2026 04:26, Shuangpeng Bai wrote:
> siw_connect() publishes a newly allocated CEP through qp->cep and gives
> the QP an association reference.
> 
> If connection setup fails while the QP is being destroyed, QP teardown
> can clear qp->cep and drop that reference first. The error path
> nevertheless drops what it assumes is the association reference. This
> consumes the local allocation reference and frees the CEP before the
> error path updates cep->state and releases cep->in_use, causing a
> use-after-free.
> 
Was that use-after-free encountered?

Can we see a stack trace?

> Serialize CEP association and error-side detachment with qp->state_lock.
> Only drop the association reference when qp->cep still points to the CEP
> being cleaned up, leaving the local reference valid until cleanup is
> complete.
> 
> Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> ---
>   drivers/infiniband/sw/siw/siw_cm.c | 15 ++++++++++-----
>   1 file changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
> index 87c79527ac09..7b32158ea49f 100644
> --- a/drivers/infiniband/sw/siw/siw_cm.c
> +++ b/drivers/infiniband/sw/siw/siw_cm.c
> @@ -1467,11 +1467,13 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
>   	siw_cep_set_inuse(cep);
>   
>   	/* Associate QP with CEP */
> +	down_write(&qp->state_lock);

What could destroy the QP at this point, so
that we need a lock? The RDMA core should serialize
any user initiated QP destroy during the connect.

>   	siw_cep_get(cep);
>   	qp->cep = cep;
>   
>   	/* siw_qp_get(qp) already done by QP lookup */
>   	cep->qp = qp;
> +	up_write(&qp->state_lock);
>   
>   	id->add_ref(id);
>   	cep->cm_id = id;
> @@ -1564,16 +1566,19 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
>   		siw_socket_disassoc(s);
>   		sock_release(s);
>   
> -		cep->qp = NULL;
> -
>   		cep->cm_id = NULL;
>   		id->rem_ref(id);
>   
> -		qp->cep = NULL;
> -		siw_cep_put(cep);
> -
>   		cep->state = SIW_EPSTATE_CLOSED;
>   

What can destroy the QP at this point?

The only possibility I see is a connection
drop from peer side, which races with the current
connect() processing. Having a lock at the cep
is sufficient to serialize that.
We hold the cep lock via siw_cep_set_inuse(),
which releasedonly the th every end of the
connect via siw_cep_set_free() (success), or
siw_cep_set_free_and_put() (failure.


> +		down_write(&qp->state_lock);
> +		cep->qp = NULL;
> +		if (qp->cep == cep) {
> +			qp->cep = NULL;
> +			siw_cep_put(cep);
> +		}
> +		up_write(&qp->state_lock);
> +
>   		siw_cep_set_free_and_put(cep);
>   
>   	} else if (s) {