From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70A6632470E; Fri, 4 Sep 2026 06:20:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788502854; cv=none; b=nVuM3D4RFZqGH1/ODf0BFVudkoCzizNWiycSz/3bjjQCoaJCSj8fL8v3hIZ7GqdOvC8sUkfSLBdX4ouOEbD8NMTJb1CvWGDnKEVOSUay0KZZnFSy+6TN7Yb22nmp/wsmm21Gad3ZzpAGgOSbtbcbnd+3MHKAEEJFx2mMBpDdZoA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788502854; c=relaxed/simple; bh=le3Lm4QJgyFyMKoJaSi5FUV5UYOk8aKCCOh/3k+VQTs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FH+kJxfGla4VALbDRjhtmiLhdljt+7WTOzCMHiYj9ZJZQq09O/i+yd8ZS6pwLYDtENsBo7t9Yye7DVG84l72QJlvy93j5JpYdDGrM4YlGW8Kwzh7XczqwU7NcWsImTQVRdPQr+WXHRvc+GfJInY/6pWKHoi7rO8WNYnpBlPjQOk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Soqej3fc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Soqej3fc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C86BA1F00A3D; Fri, 4 Sep 2026 06:20:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788502853; bh=wv+r8ujo0Nbprsp1SerCSubmpjEbmXnVXeiTurEWevc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Soqej3fca084fu4meqql4JYuVd+5CCwBTsSht9o/rrT/j3COpzAKWvh6nO4yuD30/ jgAouzEdiBYN4eg9hVLCAa6T4N+q7t5pJ8gJChcWmn/x2YZfeEZnqYPDCpsLUPQ4XO gXWUBVdgqBfeA3c5p0vMPr2pH279xlG0jXZXjvxE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bryam Vargas , Sidraya Jayagond , Tony Lu , Jakub Kicinski Subject: [PATCH 6.12 352/403] net/smc: do not dereference an unset send buffer on the SMC-D teardown path Date: Fri, 4 Sep 2026 07:02:35 +0200 Message-ID: <20260904045742.819170374@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045734.806166532@linuxfoundation.org> References: <20260904045734.806166532@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bryam Vargas commit b395dd319cea422239cb45b998fb38d7e373af87 upstream. smc_close_stream_wait() calls smc_tx_prepared_sends() from inside its sk_wait_event() condition, and sk_wait_event() evaluates that condition once with the socket lock released. smcd_buf_detach() clears conn->sndbuf_desc from smc_conn_kill() under lock_sock(), so a link group terminating while a socket waits there leaves the helper dereferencing NULL, faulting out of close(). SIOCOUTQ reads the field by hand, and smc_close_cancel_work() drops the lock across two cancel_*_sync() calls. Sample the pointer once in the helper, report nothing prepared while it is unset, and bound the ioctl the same way. The receive tasklet dereferences the field directly in smc_cdc_msg_recv_action(), not through this helper; 1/2 is what keeps it from running that late. Fixes: ae2be35cbed2 ("net/smc: {at|de}tach sndbuf to peer DMB if supported") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Reviewed-by: Sidraya Jayagond Reviewed-by: Tony Lu Link: https://patch.msgid.link/20260808-b4-disp-22f119e6-v2-2-61647601a6f3@proton.me Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/smc/af_smc.c | 3 ++- net/smc/smc_tx.h | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -3236,7 +3236,8 @@ int smc_ioctl(struct socket *sock, unsig return -EINVAL; } if (smc->sk.sk_state == SMC_INIT || - smc->sk.sk_state == SMC_CLOSED) + smc->sk.sk_state == SMC_CLOSED || + !READ_ONCE(smc->conn.sndbuf_desc)) answ = 0; else answ = smc->conn.sndbuf_desc->len - --- a/net/smc/smc_tx.h +++ b/net/smc/smc_tx.h @@ -20,11 +20,15 @@ static inline int smc_tx_prepared_sends(struct smc_connection *conn) { + struct smc_buf_desc *sndbuf_desc = READ_ONCE(conn->sndbuf_desc); union smc_host_cursor sent, prep; + if (!sndbuf_desc) + return 0; + smc_curs_copy(&sent, &conn->tx_curs_sent, conn); smc_curs_copy(&prep, &conn->tx_curs_prep, conn); - return smc_curs_diff(conn->sndbuf_desc->len, &sent, &prep); + return smc_curs_diff(sndbuf_desc->len, &sent, &prep); } void smc_tx_pending(struct smc_connection *conn);