Linux kernel (net/smc): SMC-D loopback registers DMBs (the direct memory buffers a peer reads and writes) out of

Impact

SMC-D loopback registers DMBs (the direct memory buffers a peer reads and writes) out of kmalloc memory, which is not page-backed, so the receive path cannot take a page reference before handing the buffer to a pipe. splice() from an SMC-D socket therefore runs against a buffer that can be freed under it - a use-after-free on the remote-memory-buffer path reachable by an ordinary tenant.

Who can reach it

Local and unprivileged, conditional on the SMC-D loopback ISM device being available (the smc_loopback module - present on s390 and on x86 kernels that ship loopback-ism). A tenant opens an AF_SMC socket that negotiates SMC-D over loopback and splices from it; no capability, no device node, and no RDMA hardware is needed, and socket(AF_SMC, ...) autoloads the family itself.

What to do

Boot a kernel carrying the fix commits (DMBs allocated with folio_alloc() so they are page-backed). Interim: blacklist the smc_loopback / loopback-ism module so SMC-D loopback is not offered, or blacklist smc entirely on nodes not using it.

References