Re: [PATCH net] net/smc: fix UAF on lgr list traversal in smcr_port_err()

[Dust Li <dust.li@linux.alibaba.com>]

On 2026-09-22 09:31:49, Sidraya Jayagond wrote:
>smcr_port_err() traverses smc_lgr_list.list without holding
>smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
>to free an lgr while it is still being dereferenced.
>
>Hold smc_lgr_list.lock across the traversal. Update
>smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
>
>Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
>Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
>Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>

Reviewed-by: Dust Li <dust.li@linux.alibaba.com>

Best regards,
Dust


>---
> net/smc/smc_core.c |  2 ++
> net/smc/smc_ib.c   | 10 ++++++++--
> 2 files changed, 10 insertions(+), 2 deletions(-)
>
>diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
>index 04aedd957543..9974149659c2 100644
>--- a/net/smc/smc_core.c
>+++ b/net/smc/smc_core.c
>@@ -1849,6 +1849,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
> 	struct smc_link_group *lgr, *n;
> 	int i;
> 
>+	spin_lock_bh(&smc_lgr_list.lock);
> 	list_for_each_entry_safe(lgr, n, &smc_lgr_list.list, list) {
> 		if (strncmp(smcibdev->pnetid[ibport - 1], lgr->pnet_id,
> 			    SMC_MAX_PNETID_LEN))
>@@ -1863,6 +1864,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
> 				smcr_link_down_cond_sched(lnk);
> 		}
> 	}
>+	spin_unlock_bh(&smc_lgr_list.lock);
> }
> 
> static void smc_link_down_work(struct work_struct *work)
>diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
>index 9bb495707445..daaa8a72da90 100644
>--- a/net/smc/smc_ib.c
>+++ b/net/smc/smc_ib.c
>@@ -333,6 +333,7 @@ static bool smc_ib_check_link_gid(u8 gid[SMC_GID_SIZE], bool smcrv2,
> static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
> {
> 	struct smc_link_group *lgr;
>+	bool stale_gid = false;
> 	int i;
> 
> 	spin_lock_bh(&smc_lgr_list.lock);
>@@ -348,11 +349,16 @@ static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
> 				continue;
> 			if (!smc_ib_check_link_gid(lgr->lnk[i].gid,
> 						   lgr->smc_version == SMC_V2,
>-						   smcibdev, ibport))
>-				smcr_port_err(smcibdev, ibport);
>+						   smcibdev, ibport)) {
>+				stale_gid = true;
>+				goto out;
>+			}
> 		}
> 	}
>+out:
> 	spin_unlock_bh(&smc_lgr_list.lock);
>+	if (stale_gid)
>+		smcr_port_err(smcibdev, ibport);
> }
> 
> static int smc_ib_remember_port_attr(struct smc_ib_device *smcibdev, u8 ibport)
>
>base-commit: f0b88fade64c6fe52e15b246097d10bb115d8af3
>-- 
>2.55.0