Re: [PATCH net v2 0/2] net/smc: fix use-after-free in smc_rx_pipe_buf_release()

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Thu, 20 Aug 2026 09:46:40 +0200 you wrote:
> smc_rx_pipe_buf_release() tests sk_state before taking the socket lock
> and then dereferences conn->rmb_desc and conn->lgr. A concurrent close
> runs smc_conn_free() in between, which releases those structures. On the
> is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this
> is a use-after-free.
> 
> Patch 2/2 fixes this by taking the socket lock first and testing
> conn->freed instead. smc_conn_free() sets that flag before releasing
> anything, under the same lock, so the two paths exclude each other.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/2] net/smc: stop killed, freed and out_of_sync sharing a byte
    https://git.kernel.org/netdev/net/c/db51a8658c11
  - [net,v2,2/2] net/smc: fix use-after-free in smc_rx_pipe_buf_release()
    https://git.kernel.org/netdev/net/c/c924884743e9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html