Re: [PATCH net v6 0/3] net/smc: fix out-of-bounds and use-after-free in SMC-Rv2 LLC processing
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-08-17 18:29:01
Also in:
linux-hardening, linux-rdma, linux-s390, lkml
On Wed, 12 Aug 2026 08:18:59 +0900 Yehyeong Lee wrote:
Patch 1 fixes a use-after-free of the LLC queue entry in smc_llc_srv_add_link(), patch 2 bounds the peer's rkey counts, and patch 3 carries the tail of an oversized v2 message in the queue entry so that both readers are bounded by what arrived. All three are tagged for stable: a tree that takes 1 and 2 without 3 still deletes rkeys read from whatever an earlier message left in the shared receive buffer.
SMC maintainers, please review.