Re: [PATCH net] net/smc: Serialize CLC preparation with link teardown

[sashiko-bot@kernel.org]

> smcr_clc_prep_confirm_accept() reads the RMB memory region and scatterlist
> without holding llc_conf_mutex. The connection's link reference keeps the
> link object alive, but does not prevent smcr_link_clear() from unmapping
> its buffers and destroying its RDMA resources.
> 
> The CLC handshake can load the scatterlist pointer, then an LLC delete-link
> worker can acquire llc_conf_mutex for writing and free the scatterlist in
> smcr_buf_unmap_link(). When the handshake resumes, sg_dma_address() reads
> freed memory. The memory-region rkey read has the same lifetime problem.
> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in smc_clc_send_confirm_accept
>   Read of size 8 at addr ffff88810efcdfd0 by task poc/94
>   Call Trace:
> [ ... ]
> retain priority.
> 
> Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260927074600.3694802-1-nicoyip.dev@gmail.com?part=1