Re: [PATCH] net/smc: hold a reference on net_device returned by pnet_find_base_ndev()

[sashiko-bot@kernel.org]

> pnet_find_base_ndev() resolves the base net_device for stacked devices
> under RTNL, then drops the lock and returns the raw pointer without
> taking a reference.  All three callers dereference the pointer after
> RTNL has been released, creating a use-after-free window if the device
> is concurrently unregistered.
> 
> Take dev_hold() before dropping RTNL and add the matching dev_put() in
> every return path of the three callers:
> 
>   - smc_pnet_add_eth()
>   - smc_pnet_find_roce_by_pnetid()
>   - smc_pnet_find_ism_by_pnetid()
> 
> Fixes: 0afff91c6f5e ("net/smc: add pnetid support")
> Fixes: 1619f770589a ("net/smc: add pnetid support for SMC-D and ISM")
> Cc: "D. Wythe" <alibuda@linux.alibaba.com>
> Cc: Dust Li <dust.li@linux.alibaba.com>
> Cc: Sidraya Jayagond <sidraya@linux.ibm.com>
> Cc: Mahanta Jambigi <mjambigi@linux.ibm.com>
> Cc: Tony Lu <tonylu@linux.alibaba.com>
> Cc: Wen Gu <guwen@linux.alibaba.com>
> Cc: Willy Tarreau <w@1wt.eu>
> Cc: linux-rdma@vger.kernel.org
> Cc: linux-s390@vger.kernel.org
> Cc: netdev@vger.kernel.org
> Signed-off-by: Atharva Vartak <atharva.a.vartak@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/6aba080c.b933486d.297b72.5042@mx.google.com?part=1