Re: [BUG] KASAN: slab-use-after-free in siw_cm_work_handler

[Bernard Metzler]

On 28.05.2026 05:52, Shuangpeng wrote:
> Hi Kernel Maintainers,
>
> I hit the following KASAN report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in siw_cm_work_handler
>
> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
>
> The reproducer, detailed document, and .config files are here:
> https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce
>
> I’m happy to test debug patches or provide additional information.

Thanks Shuangpeng, I will look at it next week.
I am currently travelling w/o access to any
development environment.

Thanks for reporting!
Bernard.

> Reported-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>
>
>
>
> [   60.059964][  T817] ==================================================================
> [   60.060980][  T817] BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
> [   60.062008][  T817] Write of size 8 at addr ffff888170c8ac70 by task kworker/u8:1/817
> [   60.063033][  T817]
> [   60.063347][  T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [   60.063350][  T817] Workqueue: siw_cm_wq siw_cm_work_handler
> [   60.063356][  T817] Call Trace:
> [   60.063359][  T817]  <TASK>
> [   60.063361][  T817]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
> [   60.063369][  T817]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
> [   60.063385][  T817]  kasan_report (mm/kasan/report.c:595)
> [   60.063399][  T817]  siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
> [   60.063472][  T817]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
> [   60.063477][  T817]  worker_thread (kernel/workqueue.c:3478)
> [   60.063484][  T817]  kthread (kernel/kthread.c:436)
> [   60.063495][  T817]  ret_from_fork (arch/x86/kernel/process.c:158)
> [   60.063511][  T817]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> [   60.063515][  T817]  </TASK>
> [   60.063516][  T817]
> [   60.087529][  T817] Freed by task 817 on cpu 1 at 60.059899s:
> [   60.088264][  T817]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
> [   60.088821][  T817]  kasan_save_free_info (mm/kasan/generic.c:584)
> [   60.089385][  T817]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
> [   60.089940][  T817]  kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
> [   60.090383][  T817]  siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:141 drivers/infiniband/sw/siw/siw_cm.c:1051 drivers/infiniband/sw/siw/siw_cm.c:1075)
> [   60.090979][  T817]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
> [   60.091616][  T817]  worker_thread (kernel/workqueue.c:3478)
> [   60.092191][  T817]  kthread (kernel/kthread.c:436)
> [   60.092637][  T817]  ret_from_fork (arch/x86/kernel/process.c:158)
> [   60.093226][  T817]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> [   60.093782][  T817]
> [   60.094033][  T817] The buggy address belongs to the object at ffff888170c8ac00
> [   60.094033][  T817]  which belongs to the cache kmalloc-256 of size 256
> [   60.095541][  T817] The buggy address is located 112 bytes inside of
> [   60.095541][  T817]  freed 256-byte region [ffff888170c8ac00, ffff888170c8ad00)
>
>
>
>
> Best,
> Shuangpeng