Linux kernel (net/smc): The server-side listen worker frees a connection outside the socket lock, so smc_conn_free()

Impact

The server-side listen worker frees a connection outside the socket lock, so smc_conn_free() and the link/link-group refcount drops can run twice for the same connection. The refcount saturates (addition-on-zero / underflow warnings) and the link group and link are released while still in use - a remote-driven use-after-free of the RDMA link state that a connecting peer can provoke by failing device negotiation at the right moment.

Who can reach it

Remote, pre-authentication: the double free happens in smc_listen_work / smc_listen_find_device, the server side of SMC connection setup, so any fabric peer able to reach an SMC-capable listener and abort or fail device negotiation drives it. Requires SMC in use on the listening node; the module autoloads from an unprivileged socket(AF_SMC, ...) call.

What to do

Boot a kernel carrying the fix commits (takes the socket lock across the listen-path connection teardown). Interim: keep tenant-reachable services off SMC listeners and blacklist the smc module on nodes not using SMC-R.

References