From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDB5B32A3E5; Sat, 12 Sep 2026 13:48:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789220891; cv=none; b=SqaxqPxlV8Q9tFg6HxKaTcArn3w4Bv0zXBNS1w1DdjeW9yxs/eMW8YCF9xU3iru4mRJQIT9nza/j8aonsr539+Z3hjcTpqeVvQFGuMCP0zZq0bfEabwG9OSR1vkfD2HMKb+AZ+gAbA/2Bck1F8DcrYXI7w1iYkA9csVJcW6jcr4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789220891; c=relaxed/simple; bh=XHQqT1SiWIohSdbiEGow0bAwywHBKUJ4xWMUEi5oQ2c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s2RYzjcCiOz0qmBL+hpUmfNR3K/2HtzXVao9+S9lAQzYoLghqXV5nwU8BQ24V4BpegPTlT7K9QD8dQfOnJ3W7xc8UQKr42ICmB0edYGgLS/81bty7Ht5scXAC1+FjmbD3iVbxkdp5gBZ9dFizZHH2t4LsK5GI/+dlk59r77ldWM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Wgtsq7T/; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Wgtsq7T/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC5C41F000FF; Sat, 12 Sep 2026 13:48:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789220888; bh=/v2MKNH1umFz62Fu/HOaIgTN4gtGjbjfSQj7WrCmTHs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Wgtsq7T/la196EkKTfU6MhTFqzQIoIuuxEmUHve6tdeyB5F221YIc4fvlgV+c9iXD MvsfOdzpMoj7vCwVb/MMHmqC62svQga5NR7Rb7owvElZfpMKhqvDSJUxvFswwY0ig1 sjop+4fsZY5IpqH2jH8OoSbvfl+Ry//jNvoPldqA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bryam Vargas , Sidraya Jayagond , Tony Lu , Jakub Kicinski Subject: [PATCH 6.6 0271/1424] net/smc: unregister the connection before draining the rx tasklet Date: Sat, 12 Sep 2026 08:45:03 +0200 Message-ID: <20260912065613.343499649@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065607.279695368@linuxfoundation.org> References: <20260912065607.279695368@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bryam Vargas commit 36cdf5d48ca191dcd71c28cadbe0981b1d25318d upstream. smc_conn_free() calls smc_ism_unset_conn() only while the link group is still on its device list, and never sets conn->killed. smc_lgr_terminate_sched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcd_handle_irq() open, and the device can re-arm the receive tasklet after tasklet_kill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it. Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain. Clear conn->sndbuf_desc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed. Fixes: ae2be35cbed2 ("net/smc: {at|de}tach sndbuf to peer DMB if supported") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Reviewed-by: Sidraya Jayagond Reviewed-by: Tony Lu Link: https://patch.msgid.link/20260808-b4-disp-22f119e6-v2-1-61647601a6f3@proton.me Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/smc/smc_core.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -1147,14 +1147,16 @@ static void smcd_buf_detach(struct smc_c { struct smcd_dev *smcd = conn->lgr->smcd; u64 peer_token = conn->peer_token; + struct smc_buf_desc *buf_desc; if (!conn->sndbuf_desc) return; smc_ism_detach_dmb(smcd, peer_token); - kfree(conn->sndbuf_desc); + buf_desc = conn->sndbuf_desc; conn->sndbuf_desc = NULL; + kfree(buf_desc); } static void smc_buf_unuse(struct smc_connection *conn, @@ -1198,11 +1200,10 @@ void smc_conn_free(struct smc_connection goto lgr_put; if (lgr->is_smcd) { - if (!list_empty(&lgr->list)) - smc_ism_unset_conn(conn); + smc_ism_unset_conn(conn); + tasklet_kill(&conn->rx_tsklet); if (smc_ism_support_dmb_nocopy(lgr->smcd)) smcd_buf_detach(conn); - tasklet_kill(&conn->rx_tsklet); } else { smc_cdc_wait_pend_tx_wr(conn); if (current_work() != &conn->abort_work) @@ -1455,12 +1456,12 @@ static void smc_conn_kill(struct smc_con smc_sk_wake_ups(smc); if (conn->lgr->is_smcd) { smc_ism_unset_conn(conn); - if (smc_ism_support_dmb_nocopy(conn->lgr->smcd)) - smcd_buf_detach(conn); if (soft) tasklet_kill(&conn->rx_tsklet); else tasklet_unlock_wait(&conn->rx_tsklet); + if (smc_ism_support_dmb_nocopy(conn->lgr->smcd)) + smcd_buf_detach(conn); } else { smc_cdc_wait_pend_tx_wr(conn); }