Re: [PATCH net v10] net/smc: fix lgr/lnk lifetime vs diag reader race

[sashiko-bot@kernel.org]

> The diag dump walks the socket hash table under a read_lock and dereferences
> conn->lgr and conn->lnk. Four paths expose a window where a hashed socket has
> freed or partially freed conn/lgr/lnk state.
> 
> First, smc_conn_abort() calls smc_conn_free() during early handshake aborts
> while the socket is still hashed in SMC_INIT, synchronously freeing the lgr on
> the smc_lgr_cleanup_early() path without holding the hash write_lock. A
> concurrent diag reader can load a non-NULL conn->lgr and dereference
> lgr->is_smcd after the kfree. Skip the connection, link group and DMB attributes
> in __smc_diag_dump() for sockets in SMC_INIT or SMC_CLOSED, and do not look at
> conn->lgr to determine diag_mode in SMC_INIT.
> 
> This changes the sock_diag output for such sockets. SMC_DIAG_CONNINFO,
> SMC_DIAG_LGRINFO and SMC_DIAG_DMBINFO are no longer reported while a socket is
> in SMC_INIT or SMC_CLOSED, and diag_mode is SMC_DIAG_MODE_SMCR for a
> [ ... ]
> Fixes: ae2be35cbed2 ("net/smc: {at|de}tach sndbuf to peer DMB if supported")
> Cc: stable@vger.kernel.org
> Reviewed-by: Hidayath Khan <hidayath@linux.ibm.com>
> Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com>
> Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013141510.2621698-1-mjambigi@linux.ibm.com?part=1