Re: [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A concurrent connection abort during failover causes the healthy backup link to be erroneously torn down, failing the entire link group failover.
--

--- Patch [1]: [PATCH] net/smc: fix sock refcount leak in smc_switch_conns() error path ---
commit 1858eaf3cce20ce7bd2bd6af774eda2e7fe87f8d
Author: Yifei Gao <gyf161023@gmail.com>

net/smc: fix sock refcount leak in smc_switch_conns() error path

This commit resolves a socket reference count leak in smc_switch_conns()
by ensuring sock_put() is called when smc_cdc_get_free_slot() fails.

> diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
> index b4208cb186c5e..c0027d2fe4e8c 100644
> --- a/net/smc/smc_core.c
> +++ b/net/smc/smc_core.c

[ ... ]

> @@ -1148,8 +1148,10 @@ struct smc_link *smc_switch_conns(struct smc_link_group *lgr,
>  		read_unlock_bh(&lgr->conns_lock);
>  		/* pre-fetch buffer outside of send_lock, might sleep */
>  		rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
> -		if (rc)
> +		if (rc) {
> +			sock_put(&smc->sk);
>  			goto err_out;
> +		}

[Severity: High]
This isn't a bug introduced by this patch, but this modified error path
appears to have a pre-existing logic issue during a concurrent abort.

If a concurrent abort event occurs (for example, if smc_cdc_msg_validate()
detects an invalid CDC sequence number) and sets conn->killed = 1,
smc_cdc_get_free_slot() will observe this and return -EPIPE.

Since smc_switch_conns() does not distinguish this connection-specific
error from a link-level error, it will jump directly to err_out and call
smcr_link_down_cond_sched(to_lnk).

Does this inadvertently tear down the healthy backup link and disrupt all
other connections in the link group that were successfully failing over,
just because a single connection was killed?

>  		/* avoid race with smcr_tx_sndbuf_nonempty() */
>  		spin_lock_bh(&conn->send_lock);
>  		smc_switch_link_and_count(conn, to_lnk);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260804213917.3413525-1-gyf161023@gmail.com?part=1