Linux kernel (net/smc): The CDC send-completion handler takes a lock inside an smc_sock that close() has already freed

Impact

The CDC send-completion handler takes a lock inside an smc_sock that close() has already freed, so a tenant that closes an SMC connection while a control-data-connection message is still in flight gets a use-after-free write in tasklet context. The published crash is a fatal page fault in _raw_spin_lock from the RDMA completion path - a hard node panic, with the freed-object write usable as a corruption primitive.

Who can reach it

Local and unprivileged: open an SMC-R connection, send, then close while a CDC message is outstanding - the race is between smc_release() and the WR completion tasklet, so it is a timing loop any tenant can run. Requires SMC-R actually negotiating over an RDMA device on the node; the smc module itself autoloads from an unprivileged socket(AF_SMC, ...) call.

What to do

Boot a kernel carrying the fix commits (adds a refcount so CDC completions cannot outlive the socket). Interim: blacklist smc, or deny socket family 43 to tenants, on nodes where SMC-R is not deliberately in use.

References