Linux kernel (net/smc): The SMC listen worker keeps touching the SMC socket after smc_listen_out() has handed it off

Impact

The SMC listen worker keeps touching the SMC socket after smc_listen_out() has handed it off and it may already be released, giving a use-after-free on the server side of connection setup. An unauthenticated peer that connects and disconnects at the right moment corrupts host kernel memory from a kworker context.

Who can reach it

Remote and pre-authentication: the fault is inside smc_listen_work, the handshake worker for inbound SMC connections, so any fabric or IP peer that can reach an SMC-capable listening socket drives it. The victim only needs the smc module loaded, which happens on the first unprivileged socket(AF_SMC, ...) anywhere on the node.

What to do

Boot a kernel carrying the fix commits. Interim: do not expose SMC-capable listeners to untrusted tenants or peers, and blacklist the smc module (install smc /bin/false) on nodes that do not use SMC-R.

References