Re: [PATCH 5.10] net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()

[Dust Li]

On 2026-09-01 12:05:43, Denis Arefev wrote:
>From: "D. Wythe" <alibuda@xxxxxxxxxxxxxxxxx>
>
>commit e40b801b3603a8f90b46acbacdea3505c27f01c0 upstream.
>
>There is a certain chance to trigger the following panic:
>
>PID: 5900   TASK: ffff88c1c8af4100  CPU: 1   COMMAND: "kworker/1:48"
> #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7
> #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a
> #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60
> #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7
> #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715
> #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654
> #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62
>    [exception RIP: ib_alloc_mr+19]
>    RIP: ffffffffc0c9cce3  RSP: ffff9456c1cc7c38  RFLAGS: 00010202
>    RAX: 0000000000000000  RBX: 0000000000000002  RCX: 0000000000000004
>    RDX: 0000000000000010  RSI: 0000000000000000  RDI: 0000000000000000
>    RBP: ffff88c1ea281d00   R8: 000000020a34ffff   R9: ffff88c1350bbb20
>    R10: 0000000000000000  R11: 0000000000000001  R12: 0000000000000000
>    R13: 0000000000000010  R14: ffff88c1ab040a50  R15: ffff88c1ea281d00
>    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
> #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc]
> #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc]
> #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]
>
>The reason here is that when the server tries to create a second link,
>smc_llc_srv_add_link() has no protection and may add a new link to
>link group. This breaks the security environment protected by
>llc_conf_mutex.
>
>Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server")
>Signed-off-by: D. Wythe <alibuda@xxxxxxxxxxxxxxxxx>
>Reviewed-by: Larysa Zaremba <larysa.zaremba@xxxxxxxxx>
>Reviewed-by: Wenjia Zhang <wenjia@xxxxxxxxxxxxx>
>Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
>[Denis Arefev: adapted for 5.10: smc_llc_srv_add_link() has no 
>req_qentry argument here, as SMC-Rv2 REQ_ADD_LINK support is
>not present in 5.10]
>Signed-off-by: Denis Arefev <arefev@xxxxxxxxx>

Reviewed-by: Dust Li <dust.li@xxxxxxxxxxxxxxxxx>

Best regards,
Dust