Re: [PATCH net] net/smc: fix TOCTOU race between smc_listen_out() and listener close

> smc_listen_out() reads lsmc->sk.sk_state without the listener lock,
> then acquires lock_sock_nested() only after the check passes. This
> opens a window where smc_close_active() can transition the listener
> to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept
> queue, and release the lock, all between the lockless read and the
> delayed lock acquisition:
> 
>   smc_listen_work (smc_hs_wq)          smc_close_active()
>   -------------------------------      -------------------------
>   release_sock(child)
>   if (sk_state == SMC_LISTEN) TRUE
>                                         lock_sock(listener)
>                                         sk_state = SMC_CLOSED
>                                         smc_close_cleanup_listen()
>                                         release_sock(listener)
> [ ... ]
> and the enqueue are atomic under the listener lock.
> 
> Fixes: fd57770dd198 ("net/smc: wait for pending work before clcsock release_sock")
> Reviewed-by: Mahanta Jambigi <[email protected]>
> Signed-off-by: Sidraya Jayagond <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1