Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed and

Impact

Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed and its netns reference already dropped, so a TCP retransmit timer later fires against freed memory. KASAN confirms a slab-use-after-free read in tcp_write_timer_handler - reached from timer softirq, so it destabilises the whole node rather than the calling tenant.

Who can reach it

Local and unprivileged: create and close AF_SMC sockets in a loop (the syzbot reproducer does exactly this). socket(AF_SMC, ...) needs no capability and autoloads the smc module through the net-pf-43 alias, so any tenant container reaches it - no RDMA device or /dev/infiniband access required, because the leaked object is the clcsock TCP socket.

What to do

Boot a kernel carrying the fix commits (takes a netns reference for SMC's internal kernel sockets). Interim: blacklist smc or deny socket family 43 in tenant seccomp profiles.

References