Sidraya Jayagond 61cb282fe9 net/smc: fix UAF on lgr list traversal in smcr_port_err() ...

smcr_port_err() traverses smc_lgr_list.list without holding
smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
to free an lgr while it is still being dereferenced.

Hold smc_lgr_list.lock across the traversal. Update
smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

Fixes: 541afa10c1 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
Reviewed-by: Mahanta Jambigi <[email protected]>
Signed-off-by: Sidraya Jayagond <[email protected]>
Reviewed-by: Dust Li <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

2026-09-24 10:19:50 -07:00

..

af_smc.c

net/smc: hash socket only after full initialisation in smc_sk_init()

2026-08-18 12:07:19 +02:00

Kconfig

net: smc: SMC_HS_CTRL_BPF should depend on BPF_JIT

2025-12-04 11:07:18 -08:00

Makefile

net/smc: bpf: Introduce generic hook for handshake flow

2025-11-10 11:19:41 -08:00

smc_cdc.c

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

2026-07-06 12:58:12 +02:00

smc_cdc.h

…

smc_clc.c

net/smc: avoid early lgr access in smc_clc_wait_msg

2026-04-23 11:00:57 -07:00

smc_clc.h

net/smc: check smcd_v2_ext_offset when receiving proposal msg

2024-12-15 12:34:59 +00:00

smc_close.c

net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()

2026-03-16 19:31:28 -07:00

smc_close.h

…

smc_core.c

net/smc: fix UAF on lgr list traversal in smcr_port_err()

2026-09-24 10:19:50 -07:00

smc_core.h

net/smc: handle -ENOMEM from smc_wr_alloc_link_mem gracefully

2025-10-30 13:31:43 +01:00

smc_diag.c

dibs: Local gid for dibs devices

2025-09-23 11:13:22 +02:00

smc_hs_bpf.c

net/smc: bpf: Introduce generic hook for handshake flow

2025-11-10 11:19:41 -08:00

smc_hs_bpf.h

net/smc: bpf: Introduce generic hook for handshake flow

2025-11-10 11:19:41 -08:00

smc_ib.c

net/smc: fix UAF on lgr list traversal in smcr_port_err()

2026-09-24 10:19:50 -07:00

smc_ib.h

…

smc_inet.c

net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

2026-08-27 10:54:38 +02:00

smc_inet.h

net/smc: Introduce IPPROTO_SMC

2024-06-17 13:14:09 +01:00

smc_ism.c

smc: Use flexible array for SMCD connections

2026-05-20 17:13:18 -07:00

smc_ism.h

dibs: Move data path to dibs layer

2025-09-23 11:13:22 +02:00

smc_llc.c

net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

2026-08-22 13:25:52 -07:00

smc_llc.h

…

smc_netlink.c

…

smc_netlink.h

…

smc_netns.h

…

smc_pnet.c

net/smc: Look up the pnetid ib device within the net namespace

2026-07-26 03:11:00 -04:00

smc_pnet.h

…

smc_rx.c

net/smc: fix use-after-free in smc_rx_pipe_buf_release()

2026-08-24 11:52:00 -07:00

smc_rx.h

net/smc: fix data error when recvmsg with MSG_PEEK flag

2025-01-13 18:59:00 -08:00

smc_stats.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

smc_stats.h

net/smc: introduce statistics for ringbufs usage of net namespace

2024-08-20 11:38:23 +02:00

smc_sysctl.c

net: Const qualify network templated ctl_tables Arrays

2026-08-13 13:12:24 +02:00

smc_sysctl.h

net/smc: make wr buffer count configurable

2025-10-30 13:31:43 +01:00

smc_tracepoint.c

…

smc_tracepoint.h

net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint

2026-05-12 18:44:36 -07:00

smc_tx.c

net/smc: Decouple sf and attached send_buf in smc_loopback

2025-09-23 11:13:21 +02:00

smc_tx.h

net/smc: do not dereference an unset send buffer on the SMC-D teardown path

2026-08-13 17:31:36 -07:00

smc_wr.c

net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

2026-08-22 13:25:52 -07:00

smc_wr.h

net/smc: make wr buffer count configurable

2025-10-30 13:31:43 +01:00

smc.h

net/smc: stop killed, freed and out_of_sync sharing a byte

2026-08-24 11:52:00 -07:00