Re: [BUG] RDMA/siw: KASAN: slab-use-after-free in siw_accept

Hi,

On 8/24/26 23:24, Bernard Metzler wrote:
>>
>> I suppose it is necessary to clear qp and cep before release 
>> state_lock since both siw_qp_llp_close and
>> siw_qp_modify->siw_qp_llp_close hold the lock during close cep, 
>> something like
>>
>> @@ -1719,6 +1719,16 @@ int siw_accept(struct iw_cm_id *id, struct 
>> iw_cm_conn_param *params)
>>                             SIW_QP_ATTR_STATE | SIW_QP_ATTR_LLP_HANDLE |
>>                                     SIW_QP_ATTR_ORD | SIW_QP_ATTR_IRD |
>>                                     SIW_QP_ATTR_MPA);
>> +       if (rv) {
>> +               cep->qp = NULL;
>> +               qp->cep = NULL;
>> +               siw_cep_put(cep);
>> +       }
>>          up_write(&qp->state_lock);
>>
> Thanks Guoqing, that should fix it. But even better if we
> goto error_unlock directly and remove the now obsolete
> 'if (rv != 0) goto error' below. 

That is cleaner, thanks for the suggestion.

> Can you pls provide a new patch? 

Sure, will do.

Thanks,
Guoqing