smc_switch_conns() takes a reference on the socket with sock_hold() before dropping conns_lock to prefetch a tx slot. On success the reference is released by the sock_put() after smc_switch_cursor(). When smc_cdc_get_free_slot() fails, however, the function jumps straight to err_out without a sock_put(), leaking the reference and leaving the socket unreclaimable. During SMC-R link failover with an exhausted backup link this leaks one reference per failing connection switch. Release the reference before jumping to err_out. The err_out label is also reached from the smc_switch_cursor() failure path, which has already done its own sock_put(), so the put must stay at the get_free_slot failure site rather than at the label. Fixes: c6f02ebeea3a ("net/smc: switch connections to alternate link") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao --- net/smc/smc_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c index cf6b620fef05..04c6ce608ec7 100644 --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -1148,8 +1148,10 @@ struct smc_link *smc_switch_conns(struct smc_link_group *lgr, read_unlock_bh(&lgr->conns_lock); /* pre-fetch buffer outside of send_lock, might sleep */ rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend); - if (rc) + if (rc) { + sock_put(&smc->sk); goto err_out; + } /* avoid race with smcr_tx_sndbuf_nonempty() */ spin_lock_bh(&conn->send_lock); smc_switch_link_and_count(conn, to_lnk); -- 2.43.0