Re: [PATCH net v3 3/3] net/smc: hold a link group reference for free work

[sashiko-bot@kernel.org]

> __smc_lgr_terminate() cancels free_work asynchronously. If the callback
> has already started, it can still access the group after the terminator
> drops the last reference. The callback has to dereference the group to
> find its list lock and check freeing, so that check cannot protect its
> own access to the allocation. This lifetime gap was identified during
> code review of the scheduling and early-cleanup fixes.
> 
> Take a group reference before mod_delayed_work(). Keep it when a new
> execution is queued, including when a previous callback is still running.
> If the work was already pending, release the extra reference because that
> pending execution already owns one. Release the queued reference when
> cancellation succeeds, or at every callback exit when it executes.
> 
> Use the reference-aware cancellation helper for connection reuse,
> termination and cancellation of a rearmed instance by the free worker.
> [ ... ]
> Link: https://lore.kernel.org/r/179113886433.434549.10069135669585050618@kernel.org/
> Fixes: 13085e1b5cab ("net/smc: fix deadlock triggered by cancel_delayed_work_syn()")
> Cc: stable@vger.kernel.org
> Assisted-by: GPT-6.1-Sol
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013091716.1210420-1-nicoyip.dev@gmail.com?part=3