net/smc: Serialize link activation with teardown

Browse source

smc_llc_link_active() marks a link active before scheduling its testlink
work. The first-link confirmation paths call it without llc_conf_mutex,
allowing link-down processing to clear the link between these operations:

  Connection setup                    Link-down worker
  smc_llc_link_active()
    link->state = SMC_LNK_ACTIVE
                                      smcr_link_clear()
                                        link->clearing = 1
                                        smc_llc_link_clear()
                                          cancel_delayed_work_sync()
    schedule_delayed_work()

The connection reference keeps the link alive during activation, but the
newly queued work outlives that reference. Later cleanup skips clearing
an already-clearing link, leaving its timer armed when the link group is
freed. KASAN reported:

  BUG: KASAN: use-after-free in __run_timers+0x723/0x8d0
  Write of size 8 at addr ffff88810f108810 by task swapper/1/0
  Call Trace:
   __run_timers+0x723/0x8d0
   timer_expire_remote+0xd3/0x120
   tmigr_handle_remote_up+0x4f4/0xab0
   __walk_groups_from+0x40/0x150
   tmigr_handle_remote+0x229/0x2c0
   run_timer_softirq+0x1f5/0x250

Hold llc_conf_mutex around first-link activation on both sides so that
link-down processing cannot cancel the work before it is queued. Also
protect the client's initial optional add-link processing, which can
activate a second link without the lock. The other add-link paths already
hold llc_conf_mutex. This serializes every activation with link teardown
without changing the handshake sequence or error handling.

Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Link: https://patch.msgid.link/20260927074547.3694742-1-nicoyip.dev@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Chengfeng Ye 2026-09-27 15:45:47 +08:00 • committed by Jakub Kicinski

parent 9433d2f334

commit 6cccd4b720

1 changed files with 6 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

net/smc/af_smc.c

View file