[PATCH] RDMA/siw: Fix CEP use-after-free in siw_connect()

[PATCH] RDMA/siw: Fix CEP use-after-free in siw_connect()

[Shuangpeng Bai]

siw_connect() publishes a newly allocated CEP through qp->cep and gives
the QP an association reference.

If connection setup fails while the QP is being destroyed, QP teardown
can clear qp->cep and drop that reference first. The error path
nevertheless drops what it assumes is the association reference. This
consumes the local allocation reference and frees the CEP before the
error path updates cep->state and releases cep->in_use, causing a
use-after-free.

Serialize CEP association and error-side detachment with qp->state_lock.
Only drop the association reference when qp->cep still points to the CEP
being cleaned up, leaving the local reference valid until cleanup is
complete.

Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/infiniband/sw/siw/siw_cm.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 87c79527ac09..7b32158ea49f 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1467,11 +1467,13 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
 	siw_cep_set_inuse(cep);
 
 	/* Associate QP with CEP */
+	down_write(&qp->state_lock);
 	siw_cep_get(cep);
 	qp->cep = cep;
 
 	/* siw_qp_get(qp) already done by QP lookup */
 	cep->qp = qp;
+	up_write(&qp->state_lock);
 
 	id->add_ref(id);
 	cep->cm_id = id;
@@ -1564,16 +1566,19 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
 		siw_socket_disassoc(s);
 		sock_release(s);
 
-		cep->qp = NULL;
-
 		cep->cm_id = NULL;
 		id->rem_ref(id);
 
-		qp->cep = NULL;
-		siw_cep_put(cep);
-
 		cep->state = SIW_EPSTATE_CLOSED;
 
+		down_write(&qp->state_lock);
+		cep->qp = NULL;
+		if (qp->cep == cep) {
+			qp->cep = NULL;
+			siw_cep_put(cep);
+		}
+		up_write(&qp->state_lock);
+
 		siw_cep_set_free_and_put(cep);
 
 	} else if (s) {
-- 
2.43.0

Re: [PATCH] RDMA/siw: Fix CEP use-after-free in siw_connect()

[Bernard Metzler]

On 16.08.2026 04:26, Shuangpeng Bai wrote:
> siw_connect() publishes a newly allocated CEP through qp->cep and gives
> the QP an association reference.
> 
> If connection setup fails while the QP is being destroyed, QP teardown
> can clear qp->cep and drop that reference first. The error path
> nevertheless drops what it assumes is the association reference. This
> consumes the local allocation reference and frees the CEP before the
> error path updates cep->state and releases cep->in_use, causing a
> use-after-free.
> 
Was that use-after-free encountered?

Can we see a stack trace?

> Serialize CEP association and error-side detachment with qp->state_lock.
> Only drop the association reference when qp->cep still points to the CEP
> being cleaned up, leaving the local reference valid until cleanup is
> complete.
> 
> Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> ---
>   drivers/infiniband/sw/siw/siw_cm.c | 15 ++++++++++-----
>   1 file changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
> index 87c79527ac09..7b32158ea49f 100644
> --- a/drivers/infiniband/sw/siw/siw_cm.c
> +++ b/drivers/infiniband/sw/siw/siw_cm.c
> @@ -1467,11 +1467,13 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
>   	siw_cep_set_inuse(cep);
>   
>   	/* Associate QP with CEP */
> +	down_write(&qp->state_lock);

What could destroy the QP at this point, so
that we need a lock? The RDMA core should serialize
any user initiated QP destroy during the connect.

>   	siw_cep_get(cep);
>   	qp->cep = cep;
>   
>   	/* siw_qp_get(qp) already done by QP lookup */
>   	cep->qp = qp;
> +	up_write(&qp->state_lock);
>   
>   	id->add_ref(id);
>   	cep->cm_id = id;
> @@ -1564,16 +1566,19 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
>   		siw_socket_disassoc(s);
>   		sock_release(s);
>   
> -		cep->qp = NULL;
> -
>   		cep->cm_id = NULL;
>   		id->rem_ref(id);
>   
> -		qp->cep = NULL;
> -		siw_cep_put(cep);
> -
>   		cep->state = SIW_EPSTATE_CLOSED;
>   

What can destroy the QP at this point?

The only possibility I see is a connection
drop from peer side, which races with the current
connect() processing. Having a lock at the cep
is sufficient to serialize that.
We hold the cep lock via siw_cep_set_inuse(),
which releasedonly the th every end of the
connect via siw_cep_set_free() (success), or
siw_cep_set_free_and_put() (failure.


> +		down_write(&qp->state_lock);
> +		cep->qp = NULL;
> +		if (qp->cep == cep) {
> +			qp->cep = NULL;
> +			siw_cep_put(cep);
> +		}
> +		up_write(&qp->state_lock);
> +
>   		siw_cep_set_free_and_put(cep);
>   
>   	} else if (s) {