Re: [PATCH net 1/4] net/smc: take the socket spinlock across the failover cursor switch

[sashiko-bot@kernel.org]

> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> smc_switch_cursor() rewrites the send cursors, sndbuf_space and
> peer_rmbe_space under send_lock only. smc_cdc_tx_handler() updates
> tx_curs_fin, local_tx_ctrl_fin and sndbuf_space, and
> smc_cdc_msg_recv_action() updates the peer's consumer cursor and
> peer_rmbe_space, under bh_lock_sock(). A CDC completion handled during a
> link switch can credit its bytes twice and leave tx_curs_fin ahead of
> tx_curs_sent, or leave tx_curs_sent and the producer cursor out of step,
> so the resend writes at the wrong RMB offset. A CDC received at the same
> time can be counted twice in peer_rmbe_space.
> 
> Take bh_lock_sock() around the link change and the cursor switch, in
> the order the receive path already uses (the socket spinlock, then
> send_lock).
> 
> Fixes: c6f02ebeea3a ("net/smc: switch connections to alternate link")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261029-b4-disp-33001ace-v8-0-f9bb96e17827%40proton.me?part=4
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-b4-disp-1a9ab9b0-v1-0-4a7c8d85d849@proton.me?part=1