Re: [PATCH] net/smc: fix NULL pointer dereference in smc_tcp_syn_recv_sock

On Fri, Mar 13, 2026 at 4:16 PM [off-list ref] wrote:

From: Henry Martin <redacted>

smc_tcp_syn_recv_sock() gets the SMC listener through
smc_clcsock_user_data(sk), but then dereferences it unconditionally.

During concurrent teardown, sk_user_data can already be cleared while the
hooked syn_recv_sock path is still reached, leaving smc as NULL. This
causes a NULL pointer dereference at atomic_read(&smc->queued_smc_hs).

https://lkml.org/lkml/2026/3/11/173