March 7, 2026 at 11:56, "Eric Dumazet" <edumazet@google.com mailto:edumazet@google.com?to=%22Eric%20Dumazet%22%20%3Cedumazet%40google.com%3E > wrote:

On Sat, Mar 7, 2026 at 4:22 AM Jiayuan Chen [off-list ref] wrote:

[...]

quoted

 diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
 index d0119afcc6a1..21218b9b0f9a 100644
 --- a/net/smc/af_smc.c
 +++ b/net/smc/af_smc.c
 @@ -131,7 +131,14 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
 struct smc_sock *smc;
 struct sock *child;

 + read_lock_bh(&((struct sock *)sk)->sk_callback_lock);

This will not survive a SYN flood attack.

Please use RCU instead.

quoted

smc = smc_clcsock_user_data(sk);
 + if (!smc) {
 + read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
 + return NULL;
 + }
 + sock_hold(&smc->sk);

If you must take a refcount, use

if (!refcount_inc_not_zero(&smc->sk->sk_refcnt)) {
 rcu_read_unlock();
 return NULL;
}

Thanks for the review.

Will try rcu_read_lock() + refcount_inc_not_zero()
and set SOCK_RCU_FREE on the listen socket.