[PATCH net] net/smc: fix UAF on lgr list traversal in smcr_port_err()

[PATCH net] net/smc: fix UAF on lgr list traversal in smcr_port_err()

[Sidraya Jayagond]

smcr_port_err() traverses smc_lgr_list.list without holding
smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
to free an lgr while it is still being dereferenced.

Hold smc_lgr_list.lock across the traversal. Update
smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>
---
 net/smc/smc_core.c |  2 ++
 net/smc/smc_ib.c   | 10 ++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 04aedd957543..9974149659c2 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1849,6 +1849,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
 	struct smc_link_group *lgr, *n;
 	int i;
 
+	spin_lock_bh(&smc_lgr_list.lock);
 	list_for_each_entry_safe(lgr, n, &smc_lgr_list.list, list) {
 		if (strncmp(smcibdev->pnetid[ibport - 1], lgr->pnet_id,
 			    SMC_MAX_PNETID_LEN))
@@ -1863,6 +1864,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
 				smcr_link_down_cond_sched(lnk);
 		}
 	}
+	spin_unlock_bh(&smc_lgr_list.lock);
 }
 
 static void smc_link_down_work(struct work_struct *work)
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index 9bb495707445..daaa8a72da90 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -333,6 +333,7 @@ static bool smc_ib_check_link_gid(u8 gid[SMC_GID_SIZE], bool smcrv2,
 static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
 {
 	struct smc_link_group *lgr;
+	bool stale_gid = false;
 	int i;
 
 	spin_lock_bh(&smc_lgr_list.lock);
@@ -348,11 +349,16 @@ static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
 				continue;
 			if (!smc_ib_check_link_gid(lgr->lnk[i].gid,
 						   lgr->smc_version == SMC_V2,
-						   smcibdev, ibport))
-				smcr_port_err(smcibdev, ibport);
+						   smcibdev, ibport)) {
+				stale_gid = true;
+				goto out;
+			}
 		}
 	}
+out:
 	spin_unlock_bh(&smc_lgr_list.lock);
+	if (stale_gid)
+		smcr_port_err(smcibdev, ibport);
 }
 
 static int smc_ib_remember_port_attr(struct smc_ib_device *smcibdev, u8 ibport)

base-commit: f0b88fade64c6fe52e15b246097d10bb115d8af3
-- 
2.55.0

Re: [PATCH net] net/smc: fix UAF on lgr list traversal in smcr_port_err()

[sashiko-bot]

> smcr_port_err() traverses smc_lgr_list.list without holding
> smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
> to free an lgr while it is still being dereferenced.
> 
> Hold smc_lgr_list.lock across the traversal. Update
> smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
> 
> Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
> Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
> Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922073149.474762-1-sidraya@linux.ibm.com?part=1

Re: [PATCH net] net/smc: fix UAF on lgr list traversal in smcr_port_err()

[Dust Li]

On 2026-09-22 09:31:49, Sidraya Jayagond wrote:
>smcr_port_err() traverses smc_lgr_list.list without holding
>smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
>to free an lgr while it is still being dereferenced.
>
>Hold smc_lgr_list.lock across the traversal. Update
>smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
>
>Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
>Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
>Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>

Reviewed-by: Dust Li <dust.li@linux.alibaba.com>

Best regards,
Dust


>---
> net/smc/smc_core.c |  2 ++
> net/smc/smc_ib.c   | 10 ++++++++--
> 2 files changed, 10 insertions(+), 2 deletions(-)
>
>diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
>index 04aedd957543..9974149659c2 100644
>--- a/net/smc/smc_core.c
>+++ b/net/smc/smc_core.c
>@@ -1849,6 +1849,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
> 	struct smc_link_group *lgr, *n;
> 	int i;
> 
>+	spin_lock_bh(&smc_lgr_list.lock);
> 	list_for_each_entry_safe(lgr, n, &smc_lgr_list.list, list) {
> 		if (strncmp(smcibdev->pnetid[ibport - 1], lgr->pnet_id,
> 			    SMC_MAX_PNETID_LEN))
>@@ -1863,6 +1864,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
> 				smcr_link_down_cond_sched(lnk);
> 		}
> 	}
>+	spin_unlock_bh(&smc_lgr_list.lock);
> }
> 
> static void smc_link_down_work(struct work_struct *work)
>diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
>index 9bb495707445..daaa8a72da90 100644
>--- a/net/smc/smc_ib.c
>+++ b/net/smc/smc_ib.c
>@@ -333,6 +333,7 @@ static bool smc_ib_check_link_gid(u8 gid[SMC_GID_SIZE], bool smcrv2,
> static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
> {
> 	struct smc_link_group *lgr;
>+	bool stale_gid = false;
> 	int i;
> 
> 	spin_lock_bh(&smc_lgr_list.lock);
>@@ -348,11 +349,16 @@ static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
> 				continue;
> 			if (!smc_ib_check_link_gid(lgr->lnk[i].gid,
> 						   lgr->smc_version == SMC_V2,
>-						   smcibdev, ibport))
>-				smcr_port_err(smcibdev, ibport);
>+						   smcibdev, ibport)) {
>+				stale_gid = true;
>+				goto out;
>+			}
> 		}
> 	}
>+out:
> 	spin_unlock_bh(&smc_lgr_list.lock);
>+	if (stale_gid)
>+		smcr_port_err(smcibdev, ibport);
> }
> 
> static int smc_ib_remember_port_attr(struct smc_ib_device *smcibdev, u8 ibport)
>
>base-commit: f0b88fade64c6fe52e15b246097d10bb115d8af3
>-- 
>2.55.0

Re: [PATCH net] net/smc: fix UAF on lgr list traversal in smcr_port_err()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 22 Sep 2026 09:31:49 +0200 you wrote:
> smcr_port_err() traverses smc_lgr_list.list without holding
> smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
> to free an lgr while it is still being dereferenced.
> 
> Hold smc_lgr_list.lock across the traversal. Update
> smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
> 
> [...]

Here is the summary with links:
  - [net] net/smc: fix UAF on lgr list traversal in smcr_port_err()
    https://git.kernel.org/netdev/net/c/61cb282fe97b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html