Re: [PATCH 7/7] RDMA/siw: Fix qp use-after-free in siw_get_base_qp()

[Leon Romanovsky]

On Wed, 16 Sep 2026 18:44:00 +0000, Wentao Liang wrote:
> The reference taken by siw_qp_id2obj() is dropped before the address
> of the embedded ib_qp is taken from the QP.  If that reference was
> the last one the QP is freed and the pointer returned to the iwarp
> core is dangling; the core only pins the QP with iw_add_ref() after
> the call has returned.
> 
> Copy the pointer while the reference is still held.
> 
> [...]

Applied, thanks!

[7/7] RDMA/siw: Fix qp use-after-free in siw_get_base_qp()
      https://git.kernel.org/rdma/rdma/c/ef15197f81ffed

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>