Re: [PATCH net] dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

On 27.07.26 11:35, Hidayath Khan wrote:
> dibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()
> look up the dmb_node under dmb_ht_lock, drop the lock and only then
> operate on the node's refcount. Nothing keeps the node alive across
> that window: __dibs_lo_unregister_dmb() removes the node from the hash
> table under the write lock and immediately frees it.
> 
> A concurrent final put can therefore free the node between the lookup
> and the refcount operation:
> 
> CPU0 (attach)                     CPU1 (owner unregisters)
> 
[...]
> 
> Note: commit cc21191b584c ("dibs: Move data path to dibs layer") moved
> the code to its current location; the race was introduced earlier by
> commit c3a910f2380f ("net/smc: implement DMB-merged operations of
> loopback-ism").
> 
> Tested SMC-D via ISM and dibs loopback.
> 
> Fixes: c3a910f2380f ("net/smc: implement DMB-merged operations of loopback-ism")
> Cc: [email protected]
> Signed-off-by: Hidayath Khan <[email protected]>
> Reviewed-by: Alexandra Winter <[email protected]>


For the records:
Deeper analysis showed that there is no path in the SMC code that can lead to such
a race. SMC currently is the only user of dibs_loopback and was the only user
of loopback-ism.
So the stable tag was not really necessary. Sorry for the noise.