Re: [PATCH net] net/smc: Serialize early link group cleanup with termination

[sashiko-bot@kernel.org]

> smc_lgr_cleanup_early() calls __smc_lgr_terminate() without checking or
> setting lgr->freeing. A concurrent smc_lgr_terminate_sched() can claim
> freeing and queue terminate_work before early cleanup takes lgr_lock.
> Early cleanup still enters __smc_lgr_terminate(), where both callers can
> observe lgr->terminating clear before either sets it. Both then tear down
> the same link group, causing use-after-free and duplicate resource release.
> 
> KASAN reported:
> 
>   BUG: KASAN: use-after-free in __smc_lgr_terminate+0x393/0x3a0
>   Write of size 1 at addr ffff8880bf2c0300 by task poc/106
>   Call Trace:
>    __smc_lgr_terminate+0x393/0x3a0
>    __smc_connect+0x2e3d/0x4930
>    smc_connect+0x42c/0x580
> [ ... ]
> group alive until early cleanup has checked teardown ownership.
> 
> Fixes: f9aab6f2ce57 ("net/smc: immediate freeing in smc_lgr_cleanup_early()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260927063607.3691520-1-nicoyip.dev@gmail.com?part=1