Re: [PATCH net v14] net/smc: fix lgr/lnk lifetime vs diag reader race

[sashiko-bot@kernel.org]

> The diag dump walks the socket hash table under a read_lock and
> dereferences conn->lgr and conn->lnk. Four paths expose a window where a
> hashed socket has freed or partially freed conn/lgr/lnk state.
> 
> First, smc_conn_abort() calls smc_conn_free() during early handshake
> aborts while the socket is still hashed in SMC_INIT, synchronously
> freeing the lgr on the smc_lgr_cleanup_early() path without holding the
> hash write_lock. A concurrent diag reader can load a non-NULL conn->lgr
> and dereference lgr->is_smcd after the kfree. Skip the connection, link
> group and DMB attributes in __smc_diag_dump() for sockets in SMC_INIT or
> SMC_CLOSED, and for sockets that have fallen back to TCP, and do not
> look at conn->lgr to determine diag_mode in SMC_INIT or SMC_CLOSED.
> 
> This changes the sock_diag output for such sockets. SMC_DIAG_CONNINFO,
> SMC_DIAG_LGRINFO and SMC_DIAG_DMBINFO are not read while a socket is in
> [ ... ]
> Fixes: f16a7dd5cf27 ("smc: netlink interface for SMC sockets")
> Fixes: 9dbe086c69b8 ("net/smc: fix invalid link access in dumping SMC-R connections")
> Fixes: ae2be35cbed2 ("net/smc: {at|de}tach sndbuf to peer DMB if supported")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261028070210.1685136-1-mjambigi@linux.ibm.com?part=1