Re: [PATCH] net/smc: Fix socket use-after-free in smc_shutdown()

[Dust Li]

On 2026-09-17 16:39:56, Wentao Liang wrote:
>In the fallback path, smc_shutdown() drops the passive closing
>reference on the socket with sock_put() and then still uses the socket
>by calling release_sock() at the out label. If that reference is the
>last one, for example because the passive closing reference was
>already consumed by an abort of the active link group, the socket is
>freed while it is still in use.
>
>Move the sock_put() after release_sock() so the socket is only dropped
>once it is no longer used.
>
>Fixes: 1a74e9932374 ("net/smc: Fix sock leak when release after smc_shutdown()")
>Cc: stable@xxxxxxxxxxxxxxx
>Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

Hi Wentao,

I think the patch makes sense. But have you reproduced the bug successfully?
I didn't find a path to trigger this bug. If you can give more details
on how this would happen, that would be better.

Reviewed-by: Dust Li <dust.li@xxxxxxxxxxxxxxxxx>

Best regards,
Dust