Re: [PATCH] RDMA/siw: Fix use-after-free in siw_accept()

[Leon Romanovsky]

On Sat, 01 Aug 2026 17:36:32 -0400, Shuangpeng Bai wrote:
> siw_accept() looks up the QP supplied by userspace. If that QP is
> already in RTS, the function jumps to error cleanup before associating
> the incoming CEP with it.
> 
> The cleanup tests whether qp->cep is non-NULL and assumes the current
> call installed the association. However, qp->cep can point to the CEP
> of an existing connection. The cleanup then drops a reference from the
> incoming cep, not qp->cep. Once the incoming endpoint loses its
> remaining references, this can free it before the subsequent cep->qp
> store, causing a use-after-free. It also clears the existing QP
> association.
> 
> [...]

Applied, thanks!

[1/1] RDMA/siw: Fix use-after-free in siw_accept()
      https://git.kernel.org/rdma/rdma/c/a9394971825933

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>