Linux kernel (net/smc): The IB port-up handler walks the global link-group list without holding its lock, so a fabric

Impact

The IB port-up handler walks the global link-group list without holding its lock, so a fabric port event racing tenant connect/disconnect activity dereferences a link group that is being added or freed underneath it. The published crash is a NULL dereference in smcr_port_add from the IB port-event worker - a node panic that a peer or a flapping fabric link can provoke while tenants are churning connections.

Who can reach it

Adjacent-network: the trigger is an RDMA port event (link up/flap on the RoCE/IB port), which any fabric-side disturbance produces, raced against link-group list mutation driven by tenant SMC connections. No tenant privilege is needed on either side - the tenants only have to be creating and tearing down AF_SMC connections, which is unprivileged and autoloads the module. Link flaps are routine in a large GPU-cluster fabric, so this is not a contrived race.

What to do

Boot a kernel carrying the fix commits (takes smc_lgr_list.lock around the iteration). Interim: blacklist smc on nodes not using SMC-R; there is no way to suppress port events on a live fabric, so patching is the real control.

References