)]}'
{
  "commit": "0b10cda9a56f2d20785026f56aab21cd9955dd87",
  "tree": "4b349afca39384e364876eb3d4ac9c33c5bca738",
  "parents": [
    "7f67278726e4b9442d0fad2785cd93c8304e59e2"
  ],
  "author": {
    "name": "Batsheva Black",
    "email": "bblack@nvidia.com",
    "time": "Wed Jul 15 08:33:39 2026 +0300"
  },
  "committer": {
    "name": "bblack",
    "email": "bblack@nvidia.com",
    "time": "Mon Jul 20 21:41:55 2026 +0300"
  },
  "message": "librdmacm: cm_svc: don\u0027t dispatch stale CM events after add/remove\n\ncm_svc_run() captures CM channel revents from poll(), then processes any\npending control-socket command via cm_svc_process_sock().  An RS_SVC_REM_CM\nremoves the rsocket from the svc set, after which the app thread\u0027s rclose()\nproceeds to rs_free() concurrently.  The svc thread would then walk the CM\ndispatch loop using the pre-remove revents and call rs_handle_cm_event() on\na freed rsocket, dereferencing rs-\u003ecm_id (NULL on reused memory) and\ncrashing in ucma_complete().  This is a use-after-free hit under open/close\nstress (e.g. redis-benchmark via librspreload), and affects both connect_svc\nand listen_svc, which share cm_svc_run().\n\nAfter handling the control socket, continue back to poll() instead of\ndispatching the now-stale CM revents.  Unread CM events keep the fd readable\nand will re-fire on the next poll(), so no event is lost.  Also guard\nrs_handle_cm_event() against a NULL cm_id as defense-in-depth.\n\nSigned-off-by: Batsheva Black \u003cbblack@nvidia.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "808d12773090c0266a0758fb35df7031a1a1ba21",
      "old_mode": 33188,
      "old_path": "librdmacm/rsocket.c",
      "new_id": "b489e61dd58772270a26649cff57f570d503ff09",
      "new_mode": 33188,
      "new_path": "librdmacm/rsocket.c"
    }
  ]
}