siw_mem_id2obj() finds a siw_mem with xa_load() under rcu_read_lock() and then takes a reference with kref_get_unless_zero(). This is only safe if the object stays allocated until RCU readers are done with it. siw_free_mem() frees it with kfree() as soon as the last reference is dropped, so a lookup that races with the final put reads freed memory. This happens when an MR is deregistered while an incoming RDMA WRITE looks up its STag: BUG: KASAN: slab-use-after-free in siw_mem_id2obj+0xe5/0x310 Read of size 4 at addr ff110001042aed88 by task repro-rcu2/90 Call Trace: siw_mem_id2obj+0xe5/0x310 siw_proc_write+0x282/0x430 siw_tcp_rx_data+0x12e/0xbf0 __tcp_read_sock+0x12c/0x440 siw_qp_llp_data_ready+0x147/0x260 Allocated by task 89: siw_mr_add_mem+0xb2/0x2a0 siw_reg_user_mr+0x19f/0x380 ib_uverbs_reg_mr+0x2a7/0x4c0 Freed by task 89: kfree+0x301/0x530 siw_dereg_mr+0x31/0x50 ib_dereg_mr_user+0xb9/0x200 Free siw_mem with kfree_rcu(). A lookup that loses the race then sees a zero refcount and fails. The umem or PBL is still released at the last put, since a failed lookup never touches it. Fixes: 2251334dcac9 ("rdma/siw: application buffer management") Cc: stable@vger.kernel.org Signed-off-by: Deep Shah --- drivers/infiniband/sw/siw/siw.h | 1 + drivers/infiniband/sw/siw/siw_mem.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h index dbc998248b1e..4ec9c2ac75e7 100644 --- a/drivers/infiniband/sw/siw/siw.h +++ b/drivers/infiniband/sw/siw/siw.h @@ -157,6 +157,7 @@ struct siw_mem { void *mem_obj; }; struct ib_pd *pd; + struct rcu_head rcu; }; struct siw_mr { diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c index 2a08817d3cce..be70dc9c8f81 100644 --- a/drivers/infiniband/sw/siw/siw_mem.c +++ b/drivers/infiniband/sw/siw/siw_mem.c @@ -115,7 +115,7 @@ void siw_free_mem(struct kref *ref) else kfree(mem->pbl); } - kfree(mem); + kfree_rcu(mem, rcu); } /*