Linux kernel (net/smc): Setsockopt() on an SMC socket copies the option value from user memory while holding the socket

Impact

Setsockopt() on an SMC socket copies the option value from user memory while holding the socket lock, so a tenant pointing optval at a userfaultfd- or FUSE-backed page can hold that lock forever. Combined with asynchronous shutdown work, this drains the kernel worker pool and trips the hung-task watchdog - one tenant's process wedges kworkers for every workload on the node.

Who can reach it

Local and fully unprivileged: register a userfaultfd region (or mmap a FUSE-backed file where unprivileged userfaultfd is disabled), pass it as optval to setsockopt() on an AF_SMC socket, then call shutdown() from another thread. socket(AF_SMC, ...) autoloads the module with no capability check, so any tenant container reaches it. This is a noisy-neighbour outage, not a corruption bug - but it is a whole-node one.

What to do

Boot a kernel carrying the fix commits (moves the user copy outside lock_sock). Interim: blacklist the smc module or deny socket family 43 in tenant seccomp profiles; disabling unprivileged userfaultfd (vm.unprivileged_userfaultfd=0) narrows but does not close the path, since FUSE-backed memory works too.

References