In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink()

smcllcsrvaddlink() keeps addllc pointing into the queue entry:

addllc = &qentry->msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfo(linknew, addllc); smcllc.c:1494 smcllcflowqentrydel(&lgr->llcflowlcl); smcllc.c:1495 ... u8 llcmsg = smclinksharedv2rxbuf(link) ? (u8 )lgr->wrrxbufv2 : (u8 )addllc; smcllc.c:1504 smcllcsaveaddlinkrkeys(link, linknew, llcmsg); smcllc.c:1506

smcllcflowqentrydel() kfree()s the entry, so on a link without a shared v2 receive buffer the pointer handed to smcllcsaveaddlinkrkeys() is already freed. Before the Fixes: commit that branch always used lgr->wrrxbufv2 and addllc was not used after the free.

Reproduced on an unpatched tree over rxe, with KASAN, kasanmultishot and a link forced to maxrecvsge == 1: the entry is freed and read by the same call, and the freeing frame is smcllcsrvaddlink() itself.

[ 2.523161] BUG: KASAN: slab-use-after-free in smcllcsaveaddlinkrkeys+0x333/0x350 [ 2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11 [ 2.523789] [ 2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy) [ 2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.523866] Workqueue: smchswq smclistenwork [ 2.523869] Call Trace: [ 2.523870] <TASK> [ 2.523871] dumpstacklvl+0x53/0x70 [ 2.523872] printreport+0xd0/0x630 [ 2.523874] ? pfxrawspinlockirqsave+0x10/0x10 [ 2.523876] ? smcllcsaveaddlinkrkeys+0x333/0x350 [ 2.523878] kasanreport+0xce/0x100 [ 2.523879] ? smcllcsaveaddlinkrkeys+0x333/0x350 [ 2.523881] smcllcsaveaddlinkrkeys+0x333/0x350 [ 2.523883] ? smcrbufreglgr+0x2a4/0x660 [ 2.523885] smcllcsrvaddlink+0xaa2/0x1e50 [ 2.523888] ? printk+0xba/0xf0 [ 2.523897] ? pfxsmcllcsrvaddlink+0x10/0x10 [ 2.523899] ? downwrite+0xb0/0x130 [ 2.523903] ? pfxdownwrite+0x10/0x10 [ 2.523905] smclistenwork+0x489e/0x4d00 [ 2.523907] ? kmemcachefree+0x1c6/0x3a0 [ 2.523911] ? pfxsmclistenwork+0x10/0x10 [ 2.523913] ? releasesock+0x148/0x1d0 [ 2.523915] ? smctcplistenwork+0xb4f/0xfc0 [ 2.523917] ? rawspinlockirq+0x80/0xe0 [ 2.523918] ? pfxrawspinlockirq+0x10/0x10 [ 2.523920] processonework+0x633/0x1030 [ 2.523922] ? assignwork+0x11d/0x370 [ 2.523924] workerthread+0x45b/0xd10 [ 2.523926] ? pfxworkerthread+0x10/0x10 [ 2.523928] ? pfxworkerthread+0x10/0x10 [ 2.523929] kthread+0x2c6/0x3b0 [ 2.523931] ? recalcsigpending+0x15c/0x1e0 [ 2.523934] ? pfxkthread+0x10/0x10 [ 2.523935] retfromfork+0x36e/0x5a0 [ 2.523937] ? pfxretfromfork+0x10/0x10 [ 2.523938] ? switchto+0x572/0xdd0 [ 2.523943] ? pfxkthread+0x10/0x10 [ 2.523944] retfromforkasm+0x1a/0x30 [ 2.523947] </TASK> [ 2.523948] [ 2.531253] Allocated by task 48: [ 2.531399] kasansavestack+0x33/0x60 [ 2.531570] kasansavetrack+0x14/0x30 [ 2.531737] kasankmalloc+0x8f/0xa0 [ 2.531905] kmalloccachenoprof+0x158/0x370 [ 2.532100] smcllcenqueue+0x72/0x560 [ 2.532268] smcwrrxtaskletfn+0x474/0xa80 [ 2.532491] taskletactioncommon+0x20f/0x8a0 [ 2.532714] handlesoftirqs+0x18e/0x590 [ 2.532886] dosoftirq+0x3b/0x60 [ 2.533036] localbhenableip+0x61/0x70 [ 2.533221] allocskb+0x732/0x890 [ 2.533384] rxeinitpacket+0x16b/0x4f0 [ 2.533567] prepareackpacket+0xb8/0x830 [ 2.533760] rxereceiver+0x495/0x96e0 [ 2.533933] dowork+0x144/0x470 [ 2 ---truncated---