Re: [BUG] KASAN: slab-use-after-free in siw_cm_work_handler

[Shuangpeng]

Thanks for the update.
If there is anything else I can help with on my side, feel free to let me know.

Best,
Shuangpeng

> On May 28, 2026, at 06:02, Bernard Metzler <bernard.metzler@xxxxxxxxx> wrote:
> 
> On 28.05.2026 05:52, Shuangpeng wrote:
>> Hi Kernel Maintainers,
>> I hit the following KASAN report while testing current upstream kernel:
>> KASAN: slab-use-after-free in siw_cm_work_handler
>> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
>> The reproducer, detailed document, and .config files are here:
>> https://gist.github.com/shuangpengbai/f8a60ffa1b95c54672433bd9ee82e8ce
>> I’m happy to test debug patches or provide additional information.
> 
> Thanks Shuangpeng, I will look at it next week.
> I am currently travelling w/o access to any
> development environment.
> 
> Thanks for reporting!
> Bernard.
> 
>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>
>> [   60.059964][  T817] ==================================================================
>> [   60.060980][  T817] BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
>> [   60.062008][  T817] Write of size 8 at addr ffff888170c8ac70 by task kworker/u8:1/817
>> [   60.063033][  T817]
>> [   60.063347][  T817] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
>> [   60.063350][  T817] Workqueue: siw_cm_wq siw_cm_work_handler
>> [   60.063356][  T817] Call Trace:
>> [   60.063359][  T817]  <TASK>
>> [   60.063361][  T817]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
>> [   60.063369][  T817]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
>> [   60.063385][  T817]  kasan_report (mm/kasan/report.c:595)
>> [   60.063399][  T817]  siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
>> [   60.063472][  T817]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
>> [   60.063477][  T817]  worker_thread (kernel/workqueue.c:3478)
>> [   60.063484][  T817]  kthread (kernel/kthread.c:436)
>> [   60.063495][  T817]  ret_from_fork (arch/x86/kernel/process.c:158)
>> [   60.063511][  T817]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>> [   60.063515][  T817]  </TASK>
>> [   60.063516][  T817]
>> [   60.087529][  T817] Freed by task 817 on cpu 1 at 60.059899s:
>> [   60.088264][  T817]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
>> [   60.088821][  T817]  kasan_save_free_info (mm/kasan/generic.c:584)
>> [   60.089385][  T817]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
>> [   60.089940][  T817]  kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
>> [   60.090383][  T817]  siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:141 drivers/infiniband/sw/siw/siw_cm.c:1051 drivers/infiniband/sw/siw/siw_cm.c:1075)
>> [   60.090979][  T817]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
>> [   60.091616][  T817]  worker_thread (kernel/workqueue.c:3478)
>> [   60.092191][  T817]  kthread (kernel/kthread.c:436)
>> [   60.092637][  T817]  ret_from_fork (arch/x86/kernel/process.c:158)
>> [   60.093226][  T817]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>> [   60.093782][  T817]
>> [   60.094033][  T817] The buggy address belongs to the object at ffff888170c8ac00
>> [   60.094033][  T817]  which belongs to the cache kmalloc-256 of size 256
>> [   60.095541][  T817] The buggy address is located 112 bytes inside of
>> [   60.095541][  T817]  freed 256-byte region [ffff888170c8ac00, ffff888170c8ad00)
>> Best,
>> Shuangpeng
>