Linux kernel (net/smc): On the server side of the SMC-R LLC handshake, adding a second link to a link group runs

Impact

On the server side of the SMC-R LLC handshake, adding a second link to a link group runs without the link-configuration mutex, so a remote client can race link addition against buffer registration and drive the host into ib_alloc_mr with a torn link structure. The published result is a kernel page fault during memory-region allocation - a remote, pre-authentication panic of the node from an unauthenticated connecting peer.

Who can reach it

Pre-authentication and driven entirely by the connecting peer: the LLC ADD LINK exchange happens during SMC-R connection setup, before any application-level authentication. Any host on the RDMA fabric that can complete a TCP connection to an SMC-enabled listener and negotiate SMC-R can drive it. Requires SMC-R to be in use (an RoCE/IB device plus a listener whose sockets fall into SMC), which is the normal case once the smc module is loaded.

What to do

Boot a kernel carrying the fix commits (serialises smc_llc_srv_add_link under llc_conf_mutex). Interim: stop terminating tenant or east-west traffic on SMC-R listeners, blacklist the smc module on nodes not using it, and restrict which fabric peers can open TCP connections to SMC-capable services.

References