Re: [PATCH net v2 2/2] net/smc: do not reuse the DMB of a nocopy device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] net/smc: smc_conn_free() skips smcd_rmb_drop() after
  smc_conn_kill()
--

commit 0276e117c19ed3d088959046a595c0d87ce90a1b
Author: Bryam Vargas <hexlabsecurity@proton.me>

net/smc: do not reuse the DMB of a nocopy device

This commit unregisters and frees the DMB of a nocopy SMC-D device when a
connection ends instead of returning it to the link group's buffer pool.

> diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
> index a3164201c1420..6a673ce74937e 100644
> --- a/net/smc/smc_core.c
> +++ b/net/smc/smc_core.c

[ ... ]

> @@ -1306,6 +1327,9 @@ void smc_conn_free(struct smc_connection *conn)
>  	 */
>  	if (!list_empty(&lgr->list))
>  		smc_buf_unuse(conn, lgr); /* allow buffer reuse */
> +	else if (lgr->is_smcd && conn->rmb_desc &&
> +		 smc_ism_support_dmb_nocopy(lgr->smcd))
> +		smcd_rmb_drop(conn, lgr);
>  	smc_lgr_unregister_conn(conn);
>  
>  	if (!lgr->conns_num)

[Severity: Medium]
Does smc_conn_free() skip smcd_rmb_drop() when the connection was already
killed by smc_conn_kill()?

When __smc_lgr_terminate() calls smc_conn_kill(), it detaches sndbuf_desc
and calls smc_lgr_unregister_conn(conn) (clearing conn->alert_token_local)
before smc_conn_free() runs:

net/smc/smc_core.c:smc_conn_kill() {
	...
	if (conn->lgr->is_smcd) {
		...
		if (smc_ism_support_dmb_nocopy(conn->lgr->smcd)) {
			smc->sk.sk_prot->unhash(&smc->sk);
			smcd_buf_detach(conn);
		}
	} else {
		smc_cdc_wait_pend_tx_wr(conn);
	}
	smc_lgr_unregister_conn(conn);
	smc_close_active_abort(smc);
}

When smc_conn_free() then runs (either from smc_close_active_abort() or
later from __smc_release()), smc_conn_lgr_valid(conn) is false and it
jumps to lgr_put before reaching smcd_rmb_drop().  While any other killed
socket in the link group remains open and holds a reference on lgr, the
closed connection's nocopy DMB stays registered in the device, allowing a
late peer attach to succeed on the dead connection's DMB, and
conn->rmb_desc is left non-NULL.

Running the smcd_rmb_drop() check at the lgr_put label before
smc_lgr_put(lgr) would cover both the off-list case and connections
unregistered by smc_conn_kill().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114-b4-disp-4e6374c2-v2-0-3b7050bddef7@proton.me?part=2