Linux kernel (net/smc): The CLC prefix-match check on the listen path dereferences the destination cache entry's

Impact

The CLC prefix-match check on the listen path dereferences the destination cache entry's net_device outside RCU and outside RTNL, so a device being torn down concurrently leaves the handshake reading freed memory. A peer connecting during any interface churn - VF teardown, bond member removal, container netns exit - gets a use-after-free on the server side of the SMC handshake.

Who can reach it

Remote-driven: smc_clc_prfx_match() runs inside smc_listen_work while processing an inbound CLC proposal, so an unauthenticated connecting peer supplies the timing. The race partner is ordinary netdev churn, which is constant on a multi-tenant node (per-container veths, SR-IOV VFs coming and going). Requires the smc module loaded, which any unprivileged socket(AF_SMC, ...) achieves.

What to do

Boot a kernel carrying the fix commits (uses __sk_dst_get()/dst_dev_rcu() under RCU). Interim: blacklist the smc module on nodes not using SMC-R, and avoid exposing SMC listeners to untrusted peers.

References