[PATCH] RDMA/siw: Ignore peer close events on listening endpoints

[Jaeyeong Lee]

A TCP child socket inherits the listener callbacks and sk_user_data before
kernel_accept() associates it with a new connection endpoint. If the peer
closes during this window, siw_cm_llp_state_change() queues a PEER_CLOSE
work item against the listening endpoint.

The worker releases that endpoint without removing it from the listener
list. A later listener teardown then walks the dangling entry, causing a
use-after-free in siw_destroy_listen().

With a listener backlog of at least two, an unauthenticated TCP peer can
reach this path by resetting a new connection before the accept worker
runs.

Ignore close notifications while the endpoint is still listening. Once
the child is accepted, its sk_user_data points to the new endpoint and
close notifications continue through the normal path.

Static analysis identified the issue. It reproduced twice on Linux
7.4-rc1 with SIW over loopback in QEMU. KASAN reported the endpoint
allocated by siw_create_listen(), freed by siw_cm_work_handler(), and
reused by siw_destroy_listen(). The same reproducer completed without
KASAN or lockdep reports after this change on one- and two-CPU guests.

Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jaeyeong Lee <lee@xxxxxxxxxxx>
---
 drivers/infiniband/sw/siw/siw_cm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index ed49818793dde..518f09a2d37cf 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1361,6 +1361,8 @@ static void siw_cm_llp_state_change(struct sock *sk)
 
 	case TCP_CLOSE:
 	case TCP_CLOSE_WAIT:
+		if (cep->state == SIW_EPSTATE_LISTENING)
+			break;
 		if (cep->qp)
 			cep->qp->tx_ctx.tx_suspend = 1;
 		siw_cm_queue_work(cep, SIW_CM_WORK_PEER_CLOSE);
-- 
2.43.0