Re: [PATCH net] net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

patchwork-bot+netdevbpf
2026-03-21T02:10:20Z

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 18 Mar 2026 14:48:47 +0800 you wrote:
> smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores
> the pointer in pipe_buffer.private. The pipe_buf_operations for these
> buffers used .get = generic_pipe_buf_get, which only increments the page
> reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv
> pointer itself was not handled, so after tee() both the original and the
> cloned pipe_buffer share the same smc_spd_priv *.
>
> [...]

Here is the summary with links:
- [net] net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
https://git.kernel.org/netdev/net/c/24dd586bb4cb

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.