Re: [PATCH net v9] net/smc: fix lgr/lnk lifetime vs diag reader race

[sashiko-bot@kernel.org]

> The diag dump walks the socket hash table under a read_lock and dereferences
> conn->lgr and conn->lnk. Four paths expose a window where a hashed socket has
> freed or partially freed conn/lgr/lnk state.
> 
> First, smc_conn_abort() calls smc_conn_free() during early handshake aborts
> while the socket is still hashed in SMC_INIT, synchronously freeing the lgr on
> the smc_lgr_cleanup_early() path without holding the hash write_lock. A
> concurrent diag reader can load a non-NULL conn->lgr and dereference
> lgr->is_smcd after the kfree. Guard the conn/lgr/lnk blocks in __smc_diag_dump()
> for SMC_INIT and SMC_CLOSED sockets. As a side effect the diag_mode field is
> reported as SMC_DIAG_MODE_SMCR for SMC-D sockets still in SMC_INIT; smcss
> suppresses those rows before printing the mode string so there is no rendered
> regression. Use smp_load_acquire() / smp_store_release() on sk_state to order
> these checks on weakly ordered CPUs.
> 
> [ ... ]
> Fixes: ae2be35cbed2 ("net/smc: {at|de}tach sndbuf to peer DMB if supported")
> Cc: stable@vger.kernel.org
> Reviewed-by: Hidayath Khan <hidayath@linux.ibm.com>
> Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com>
> Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012080034.38770-1-mjambigi@linux.ibm.com?part=1