Re: [PATCH rdma-rc] RDMA/siw: Fix use-after-free in siw_mem_id2obj()

[Leon Romanovsky]

On Mon, 02 Nov 2026 06:44:37 +0000, Deep Shah wrote:
> siw_mem_id2obj() finds a siw_mem with xa_load() under rcu_read_lock()
> and then takes a reference with kref_get_unless_zero(). This is only
> safe if the object stays allocated until RCU readers are done with it.
> siw_free_mem() frees it with kfree() as soon as the last reference is
> dropped, so a lookup that races with the final put reads freed memory.
> 
> This happens when an MR is deregistered while an incoming RDMA WRITE
> looks up its STag:
> 
> [...]

Applied, thanks!

[1/1] RDMA/siw: Fix use-after-free in siw_mem_id2obj()
      https://git.kernel.org/rdma/rdma/c/a70672b9b3ac7d

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>