Linux kernel SMC-D diagnostics (smc_diag, rmb_desc access during connection dump): Dumping SMC-D connections while

Impact

Dumping SMC-D connections while connections are churning dereferences a remote memory buffer descriptor that has already gone away, crashing the node. The reproducer is nothing exotic - run a web benchmark under smc_run and poll smcss -D in a loop. That means routine monitoring can kill a node, and it also means a tenant able to trigger the diag dump path can do so deliberately while generating connection churn.

Who can reach it

Local. Requires the ability to issue SMC diag netlink dumps while SMC connections are being torn down; monitoring agents do this on a timer.

What to do

Kernel update guarding the rmb_desc access. Until patched, stop polling SMC diagnostics on nodes carrying live SMC traffic - the monitoring is the trigger.

References