Re: [PATCH net v4] net/smc: fix lgr/lnk lifetime vs diag reader race

[Dust Li <dust.li@linux.alibaba.com>]

On 2026-09-11 11:09:06, Mahanta Jambigi wrote:
>The diag dump walks the socket hash table under a read_lock and dereferences
>conn->lgr and conn->lnk.  Two terminal teardown paths drop those references via
>smc_conn_free() while the socket is still hashed:
>
>  - smc_conn_kill() -> smc_close_active_abort() -> smc_conn_free()
>  - smc_close_passive_work() -> smc_conn_free()
>
>This allows the diag reader to dereference a freed lgr or lnk.
>
>Fix it by unhashing the socket before smc_conn_free() is called at each of these
>two sites.  Any socket visible to the diag reader under the hash read_lock then
>has valid conn->lgr and conn->lnk pointers.
>
>Fixes: f16a7dd5cf27 ("smc: netlink interface for SMC sockets")
>Fixes: 9dbe086c69b8 ("net/smc: fix invalid link access in dumping SMC-R connections")
>Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
>---
>Changes in v4:
>- dropped smc_conn_unhash() wrapper, conn->unhashed flag, and all
>  changes to af_smc.c, smc.h, smc_core.c and smc_core.h; smc_unhash_sk()
>  is already idempotent via sk_hashed(), so direct calls at the two
>  teardown sites in smc_close.c are sufficient
>- dropped the __smc_release() hunk: it needs no change since the
>  subsequent unhash there is already a safe no-op
>- fixed premature-unhash issue present in v3: smc_conn_free() must not
>  unhash because smc_conn_abort() calls it before smc_switch_to_fallback()
>  in both smc_listen_decline() and smc_connect_rdma() error paths;
>  unhashing there would make live fallback sockets invisible to smcss
>- likewise, the ISM/RDMA retry loops (smc_find_ism_v2_device_serv(),
>  smc_find_rdma_v2_device_serv()) call smc_conn_abort() on a failed
>  attempt and then smc_conn_create() on the next device; unhashing in
>  smc_conn_free() would permanently hide the established connection from
>  smc_diag since smc_conn_create() does not re-hash the socket

Hi Mahanta,

This version looks clean. And you explained why we can't call unhash in
smc_conn_abort() well. But smc_conn_abort() still calls smc_conn_free(),
when the smc_sk is still hashed, is there still a race window with dump ?

Best regards,
Dust