Re: [PATCH net v4] net/smc: order the CDC receive path against buffer publication

[Dust Li]

On 2026-07-28 11:52:53, Bryam Vargas via B4 Relay wrote:
>From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
>
>The SMC CDC receive handlers dereference conn->rmb_desc, and on the
>SMC-D DMB-nocopy path conn->sndbuf_desc, but both are published after the
>connection is already reachable to a peer: rmb_desc once the connection
>is in the link group's token tree, the nocopy ghost sndbuf_desc later
>still, in smcd_buf_attach() after the ISM receive tasklet is armed. A CDC
>in that window hits a handler with the buffer unset -- a NULL dereference
>and host DoS -- or, on a weakly ordered CPU, non-NULL but not yet
>initialised. Both are also published before the receive state
>(bytes_to_rcv, sndbuf_space), so an early CDC's accounting can be
>overwritten by setup.
>
>Initialise the receive state first and publish both buffers last with
>smp_store_release(), consuming them with smp_load_acquire() and bailing
>while unset, as the handlers already do for a killed connection. Gate the
>whole sndbuf consumer trigger on the send buffer, not just the nocopy
>accounting: smc_tx_prepared_sends() and smc_tx_pending() dereference it
>too. Conforming peers are unaffected.
>
>Fixes: 69cb7dc0218b ("net/smc: add common buffer size in send and receive buffer descriptors")
>Closes: https://sashiko.dev/#/patchset/20260714-b4-disp-835288a6-v2-1-581555ef2145@xxxxxxxxx?part=1
>Cc: stable@xxxxxxxxxxxxxxx
>Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>

Hi Bryam,

Thanks for finding this corner case !

Reviewed-by: Dust Li <dust.li@xxxxxxxxxxxxxxxxx>

Best regards,
Dust