* Re: [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path
2026-08-04 21:39 [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path Yifei Gao
@ 2026-08-05 3:18 ` Tony Lu
2026-08-05 4:40 ` Mahanta Jambigi
2026-08-05 6:26 ` Hidayathulla Khan I
2 siblings, 0 replies; 4+ messages in thread
From: Tony Lu @ 2026-08-05 3:18 UTC (permalink / raw)
To: Yifei Gao
Cc: D . Wythe, Dust Li, Sidraya Jayagond, Mahanta Jambigi, linux-rdma,
linux-s390, netdev, Wen Gu, Karsten Graul, Ursula Braun,
Wenjia Zhang, linux-kernel, stable
> Subject: [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path
Please use [PATCH net] as the subject prefix when sending v2, since
this fix targets the net tree.
On Tue, Aug 04, 2026 at 09:39:17PM +0000, Yifei Gao wrote:
> smc_switch_conns() takes a reference on the socket with sock_hold() before
> dropping conns_lock to prefetch a tx slot. On success the reference is
> released by the sock_put() after smc_switch_cursor(). When
> smc_cdc_get_free_slot() fails, however, the function jumps straight to
> err_out without a sock_put(), leaking the reference and leaving the socket
> unreclaimable. During SMC-R link failover with an exhausted backup link
> this leaks one reference per failing connection switch.
>
> Release the reference before jumping to err_out. The err_out label is also
> reached from the smc_switch_cursor() failure path, which has already done
> its own sock_put(), so the put must stay at the get_free_slot failure site
> rather than at the label.
>
> Fixes: c6f02ebeea3a ("net/smc: switch connections to alternate link")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Yifei Gao <gyf161023@gmail.com>
> ---
> net/smc/smc_core.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
> index cf6b620fef05..04c6ce608ec7 100644
> --- a/net/smc/smc_core.c
> +++ b/net/smc/smc_core.c
> @@ -1148,8 +1148,10 @@ struct smc_link *smc_switch_conns(struct smc_link_group *lgr,
> read_unlock_bh(&lgr->conns_lock);
> /* pre-fetch buffer outside of send_lock, might sleep */
> rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
> - if (rc)
> + if (rc) {
> + sock_put(&smc->sk);
> goto err_out;
> + }
> /* avoid race with smcr_tx_sndbuf_nonempty() */
> spin_lock_bh(&conn->send_lock);
> smc_switch_link_and_count(conn, to_lnk);
> --
> 2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path
2026-08-04 21:39 [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path Yifei Gao
2026-08-05 3:18 ` Tony Lu
@ 2026-08-05 4:40 ` Mahanta Jambigi
2026-08-05 6:26 ` Hidayathulla Khan I
2 siblings, 0 replies; 4+ messages in thread
From: Mahanta Jambigi @ 2026-08-05 4:40 UTC (permalink / raw)
To: Yifei Gao, D . Wythe, Dust Li, Sidraya Jayagond, linux-rdma,
linux-s390, netdev, Hidayath Khan
Cc: Tony Lu, Wen Gu, Karsten Graul, Ursula Braun, Wenjia Zhang,
linux-kernel, stable
On 05/08/26 3:09 am, Yifei Gao wrote:
> smc_switch_conns() takes a reference on the socket with sock_hold() before
> dropping conns_lock to prefetch a tx slot. On success the reference is
> released by the sock_put() after smc_switch_cursor(). When
> smc_cdc_get_free_slot() fails, however, the function jumps straight to
> err_out without a sock_put(), leaking the reference and leaving the socket
> unreclaimable. During SMC-R link failover with an exhausted backup link
> this leaks one reference per failing connection switch.
>
> Release the reference before jumping to err_out. The err_out label is also
> reached from the smc_switch_cursor() failure path, which has already done
> its own sock_put(), so the put must stay at the get_free_slot failure site
> rather than at the label.
>
> Fixes: c6f02ebeea3a ("net/smc: switch connections to alternate link")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Yifei Gao <gyf161023@gmail.com>
> ---
> net/smc/smc_core.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
> index cf6b620fef05..04c6ce608ec7 100644
> --- a/net/smc/smc_core.c
> +++ b/net/smc/smc_core.c
> @@ -1148,8 +1148,10 @@ struct smc_link *smc_switch_conns(struct smc_link_group *lgr,
> read_unlock_bh(&lgr->conns_lock);
> /* pre-fetch buffer outside of send_lock, might sleep */
> rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
> - if (rc)
> + if (rc) {
> + sock_put(&smc->sk);
> goto err_out;
> + }
This patch has already been posted by Hidayath:
https://lore.kernel.org/netdev/20260804082800.498672-1-hidayath@linux.ibm.com/
Adding Hidayath to confirm, but this appears to be a duplicate submission.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path
2026-08-04 21:39 [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path Yifei Gao
2026-08-05 3:18 ` Tony Lu
2026-08-05 4:40 ` Mahanta Jambigi
@ 2026-08-05 6:26 ` Hidayathulla Khan I
2 siblings, 0 replies; 4+ messages in thread
From: Hidayathulla Khan I @ 2026-08-05 6:26 UTC (permalink / raw)
To: Yifei Gao, D . Wythe, Dust Li, Sidraya Jayagond, Mahanta Jambigi,
linux-rdma, linux-s390, netdev
Cc: Tony Lu, Wen Gu, Karsten Graul, Ursula Braun, Wenjia Zhang,
linux-kernel, stable
Hi Yifei,
Thanks for looking into this.
Yes I have submitted a patch for the same issue.
https://lore.kernel.org/netdev/20260804082800.498672-1-hidayath@linux.ibm.com/
Hidayath
On 05/08/26 3:09 am, Yifei Gao wrote:
> smc_switch_conns() takes a reference on the socket with sock_hold() before
> dropping conns_lock to prefetch a tx slot. On success the reference is
> released by the sock_put() after smc_switch_cursor(). When
> smc_cdc_get_free_slot() fails, however, the function jumps straight to
> err_out without a sock_put(), leaking the reference and leaving the socket
> unreclaimable. During SMC-R link failover with an exhausted backup link
> this leaks one reference per failing connection switch.
>
> Release the reference before jumping to err_out. The err_out label is also
> reached from the smc_switch_cursor() failure path, which has already done
> its own sock_put(), so the put must stay at the get_free_slot failure site
> rather than at the label.
>
> Fixes: c6f02ebeea3a ("net/smc: switch connections to alternate link")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Yifei Gao <gyf161023@gmail.com>
> ---
> net/smc/smc_core.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
> index cf6b620fef05..04c6ce608ec7 100644
> --- a/net/smc/smc_core.c
> +++ b/net/smc/smc_core.c
> @@ -1148,8 +1148,10 @@ struct smc_link *smc_switch_conns(struct smc_link_group *lgr,
> read_unlock_bh(&lgr->conns_lock);
> /* pre-fetch buffer outside of send_lock, might sleep */
> rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
> - if (rc)
> + if (rc) {
> + sock_put(&smc->sk);
> goto err_out;
> + }
> /* avoid race with smcr_tx_sndbuf_nonempty() */
> spin_lock_bh(&conn->send_lock);
> smc_switch_link_and_count(conn, to_lnk);
^ permalink raw reply [flat|nested] 4+ messages in thread