Merge branch 'net-smc-fix-out-of-bounds-and-use-after-free-in-smc-rv2-llc-processing'

Browse source

Yehyeong Lee says:

====================
net/smc: fix out-of-bounds and use-after-free in SMC-Rv2 LLC processing

Patch 1 fixes a use-after-free of the LLC queue entry in
smc_llc_srv_add_link(), patch 2 bounds the peer's rkey counts, and patch 3
carries the tail of an oversized v2 message in the queue entry so that both
readers are bounded by what arrived. All three are tagged for stable: a
tree that takes 1 and 2 without 3 still deletes rkeys read from whatever an
earlier message left in the shared receive buffer.
====================

Link: https://patch.msgid.link/20260819023306.644849-1-yhlee@isslab.korea.ac.kr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Jakub Kicinski 2026-08-22 13:25:54 -07:00

parent f05516dd7b 8d3c1ab82c

commit e16d750a90

2 changed files with 98 additions and 30 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

122

net/smc/smc_llc.c

View file

6

net/smc/smc_wr.c

View file