From: Dust Li <dust.li@linux.alibaba.com>
To: Wentao Liang <vulab@iscas.ac.cn>, alibuda@linux.alibaba.com
Cc: davem@davemloft.net, edumazet@google.com,
guwen@linux.alibaba.com, horms@kernel.org, kgraul@linux.ibm.com,
kuba@kernel.org, linux-kernel@vger.kernel.org,
linux-rdma@vger.kernel.org, linux-s390@vger.kernel.org,
mjambigi@linux.ibm.com, netdev@vger.kernel.org,
pabeni@redhat.com, sidraya@linux.ibm.com,
tonylu@linux.alibaba.com, wenjia@linux.ibm.com,
stable@vger.kernel.org
Subject: Re: [PATCH] net/smc: Fix socket use-after-free in smc_shutdown()
Date: Mon, 21 Sep 2026 16:18:36 +0800 [thread overview]
Message-ID: <arDoXGUu5ve2oew4@linux.alibaba.com> (raw)
In-Reply-To: <20260917163956.2162779-1-vulab@iscas.ac.cn>
On 2026-09-17 16:39:56, Wentao Liang wrote:
>In the fallback path, smc_shutdown() drops the passive closing
>reference on the socket with sock_put() and then still uses the socket
>by calling release_sock() at the out label. If that reference is the
>last one, for example because the passive closing reference was
>already consumed by an abort of the active link group, the socket is
>freed while it is still in use.
>
>Move the sock_put() after release_sock() so the socket is only dropped
>once it is no longer used.
>
>Fixes: 1a74e9932374 ("net/smc: Fix sock leak when release after smc_shutdown()")
>Cc: stable@vger.kernel.org
>Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Hi Wentao,
I think the patch makes sense. But have you reproduced the bug successfully?
I didn't find a path to trigger this bug. If you can give more details
on how this would happen, that would be better.
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Best regards,
Dust
next prev parent reply other threads:[~2026-09-21 8:18 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-17 16:39 [PATCH] net/smc: Fix socket use-after-free in smc_shutdown() Wentao Liang
2026-09-17 16:59 ` sashiko-bot
2026-09-21 8:18 ` Dust Li [this message]
2026-09-21 15:04 ` krzk
2026-09-21 15:08 ` krzk
2026-09-21 15:16 ` krzk
2026-09-21 17:34 ` netdev-bot+sashiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=arDoXGUu5ve2oew4@linux.alibaba.com \
--to=dust.li@linux.alibaba.com \
--cc=alibuda@linux.alibaba.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=guwen@linux.alibaba.com \
--cc=horms@kernel.org \
--cc=kgraul@linux.ibm.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=mjambigi@linux.ibm.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sidraya@linux.ibm.com \
--cc=stable@vger.kernel.org \
--cc=tonylu@linux.alibaba.com \
--cc=vulab@iscas.ac.cn \
--cc=wenjia@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.