Linux kernel (net/smc): Link-group termination drops conns_lock after finding a connection but before taking a socket

Impact

Link-group termination drops conns_lock after finding a connection but before taking a socket reference, so a concurrent close can free the socket the termination worker is about to write to. KASAN confirms a slab-use-after-free write from smc_lgr_terminate_work - a fabric event that overlaps a tenant closing its connection turns into host memory corruption.

Who can reach it

Reachable whenever link-group termination overlaps connection close. Termination is driven from the fabric side (link down, device event, peer-initiated teardown) while the close is an unprivileged tenant operation, so neither half needs privilege. The write lands in a kworker, so the blast radius is the node, not the tenant. Requires SMC-R in use; the module autoloads from an unprivileged socket(AF_SMC, ...).

What to do

Boot a kernel carrying the fix commits (takes the socket reference while conns_lock still protects the tree entry). Interim: blacklist the smc module on nodes not running SMC-R, and keep untrusted tenants off the fabric segment that can drive link-group termination.

References