Linux kernel (net/smc): When an incoming connection tries SMC-Rv2 and device setup fails, the listener does not reset

Impact

When an incoming connection tries SMC-Rv2 and device setup fails, the listener does not reset the connection and goes on to build the CLC ACCEPT/CONFIRM message from half-initialised state, dereferencing a NULL link pointer inside the handshake worker. A remote client can crash the server node during connection setup, before any authentication, and the reproducer is nothing more exotic than nginx plus a load generator over SMC-R.

Who can reach it

Remote and pre-authentication: the fault is in smc_listen_work / smc_clc_send_confirm_accept, i.e. the server side of the CLC handshake, reachable by any fabric peer that connects to an SMC-enabled listening service. Requires SMC-Rv2 negotiation over RoCE (the report used two Mellanox ConnectX-4 adapters); the crash is in a kworker, so it takes the node with it.

What to do

Boot a kernel carrying the fix commits (resets the connection when SMC-Rv2 setup fails). Interim: disable SMC-Rv2 negotiation, keep tenant-reachable services off SMC listeners, and blacklist the smc module on nodes that do not need it.

References