Re: [PATCH 7/7] RDMA/siw: Fix qp use-after-free in siw_get_base_qp()

[Bernard Metzler]

On 23.09.2026 10:35, Leon Romanovsky wrote:
> On Wed, 16 Sep 2026 18:44:00 +0000, Wentao Liang wrote:
> > The reference taken by siw_qp_id2obj() is dropped before the address
> > of the embedded ib_qp is taken from the QP.  If that reference was
> > the last one the QP is freed and the pointer returned to the iwarp
> > core is dangling; the core only pins the QP with iw_add_ref() after
> > the call has returned.
> >
> > Copy the pointer while the reference is still held.
> >
> > [...]
>
> Applied, thanks!
>
> [7/7] RDMA/siw: Fix qp use-after-free in siw_get_base_qp()
>        https://git.kernel.org/rdma/rdma/c/ef15197f81ffed
>
> Best regards,
excellent, thanks.