Re: [PATCH net v2 0/2] net/smc: fix use-after-free in smc_rx_pipe_buf_release()

[Simon Horman <horms@kernel.org>]

On Thu, Aug 20, 2026 at 09:46:40AM +0200, Hidayath Khan wrote:
> smc_rx_pipe_buf_release() tests sk_state before taking the socket lock
> and then dereferences conn->rmb_desc and conn->lgr. A concurrent close
> runs smc_conn_free() in between, which releases those structures. On the
> is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this
> is a use-after-free.
> 
> Patch 2/2 fixes this by taking the socket lock first and testing
> conn->freed instead. smc_conn_free() sets that flag before releasing
> anything, under the same lock, so the two paths exclude each other.
> 
> Patch 1/2 is a prerequisite. conn->freed shares a byte with killed and
> out_of_sync as single-bit bitfields. out_of_sync is written from the
> receive tasklet without the socket lock, so a concurrent store to freed
> from process context can be lost in the read-modify-write. Patch 1/2
> gives each flag its own byte so stores do not interfere.
> 
> Hidayath Khan (2):
>   net/smc: stop killed, freed and out_of_sync sharing a byte
>   net/smc: fix use-after-free in smc_rx_pipe_buf_release()
> 
>  net/smc/smc.h    |  6 +++---
>  net/smc/smc_rx.c | 11 +++++------
>  2 files changed, 8 insertions(+), 9 deletions(-)
> 
> ---
> v2:
> - Patch 1/2 is new. It is a prerequisite for 2/2.
> - Patch 2/2 replaces the conn->rmb_desc = NULL approach from v1 with a
>   conn->freed check. The NULL store exposed smc_cdc_msg_recv_action()
>   and the sock_diag dump to NULL dereferences on paths that do not take
>   the socket lock.

Thanks for the updates.

The AI-generated reviews provided by sashiko-bot elsewhere in this
thread appear to relate to pre-existing issues that I don't believe
should impact the progress of this patch.

For the series:
Reviewed-by: Simon Horman <horms@kernel.org>