Linux kernel (net/smc): A link-down work item can be queued before the link group is freed but run after, so the worker

Impact

A link-down work item can be queued before the link group is freed but run after, so the worker operates on a freed link group - the published crash is list corruption (prev->next NULL) inside smc_link_down_work, i.e. a write through a freed pointer from a kworker. A peer that can flap an SMC-R link while connections are closing turns fabric noise into host memory corruption.

Who can reach it

Driven from the RDMA fabric: link-down work is scheduled from link/port events on the RoCE or IB device, and the race is against link-group teardown that tenants drive by closing SMC connections. No credentials are needed on either side - the fabric peer only has to cause a link event, and the local side only has to be running SMC-R (the smc module autoloads on an unprivileged socket(AF_SMC, ...)).

What to do

Boot a kernel carrying the fix commits (takes a link-group reference across the link-down work). Interim: blacklist the smc module on nodes not using SMC-R, and keep untrusted tenants off the RDMA fabric segment that can generate link events.

References