From: sashiko-bot@kernel.org
To: "Wentao Liang" <vulab@iscas.ac.cn>
Cc: "Heiko Carstens" <hca@linux.ibm.com>,
"Vasily Gorbik" <gor@linux.ibm.com>,
"Alexander Gordeev" <agordeev@linux.ibm.com>,
linux-s390@vger.kernel.org,
"Christian Borntraeger" <borntraeger@linux.ibm.com>,
linux-rdma@vger.kernel.org
Subject: Re: [PATCH] net/smc: Fix socket use-after-free in smc_shutdown()
Date: Thu, 17 Sep 2026 16:59:36 +0000 [thread overview]
Message-ID: <20260917165936.9377B1F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260917163956.2162779-1-vulab@iscas.ac.cn>
> In the fallback path, smc_shutdown() drops the passive closing
> reference on the socket with sock_put() and then still uses the socket
> by calling release_sock() at the out label. If that reference is the
> last one, for example because the passive closing reference was
> already consumed by an abort of the active link group, the socket is
> freed while it is still in use.
>
> Move the sock_put() after release_sock() so the socket is only dropped
> once it is no longer used.
>
> Fixes: 1a74e9932374 ("net/smc: Fix sock leak when release after smc_shutdown()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260917163956.2162779-1-vulab@iscas.ac.cn?part=1
next prev parent reply other threads:[~2026-09-17 16:59 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-17 16:39 [PATCH] net/smc: Fix socket use-after-free in smc_shutdown() Wentao Liang
2026-09-17 16:59 ` sashiko-bot [this message]
2026-09-21 8:18 ` Dust Li
2026-09-21 15:04 ` krzk
2026-09-21 15:08 ` krzk
2026-09-21 15:16 ` krzk
2026-09-21 17:34 ` netdev-bot+sashiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260917165936.9377B1F000FF@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=agordeev@linux.ibm.com \
--cc=borntraeger@linux.ibm.com \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=linux-rdma@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=vulab@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.