Re: [PATCH] RDMA/siw: Fix use-after-free in siw_accept()
Leon Romanovsky <[email protected]>
| Newsgroups | org.kernel.vger.linux-rdma,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 01 Aug 2026 17:36:32 -0400, Shuangpeng Bai wrote:
> siw_accept() looks up the QP supplied by userspace. If that QP is
> already in RTS, the function jumps to error cleanup before associating
> the incoming CEP with it.
>
> The cleanup tests whether qp->cep is non-NULL and assumes the current
> call installed the association. However, qp->cep can point to the CEP
> of an existing connection. The cleanup then drops a reference from the
> incoming cep, not qp->cep. Once the incoming endpoint loses its
> remaining references, this can free it before the subsequent cep->qp
> store, causing a use-after-free. It also clears the existing QP
> association.
>
> [...]
Applied, thanks!
[1/1] RDMA/siw: Fix use-after-free in siw_accept()
https://git.kernel.org/rdma/rdma/c/a9394971825933
Best regards,
--
Leon Romanovsky <[email protected]>