AZL-96326

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix socket use-after-free during link group termination

__smclgrterminate() drops connslock after finding a connection in lgr->connsall, but before taking a reference on its socket. The connection is embedded in the socket, and its registration reference protects it only while the connection remains in the tree.

A concurrent close can unregister the connection and drop that reference, freeing the socket before the termination worker reaches sock_hold().

The race is reachable when close overlaps link group termination. Local stress testing reproduced the use-after-free and KASAN reported:

BUG: KASAN: slab-use-after-free in __smclgrterminate.part.0 [smc] Write of size 4 by task kworker/3:3 Workqueue: events smc_lgrterminatework [smc] __smclgrterminate.part.0 [smc]

The socket was allocated by smccreate(), freed through slabfreeafterrcu_debug(), and was followed by:

refcount_t: addition on 0; use-after-free. __smclgrterminate.part.0 [smc]

Take the socket reference while conns_lock still protects the tree entry. The unregister path then cannot drop the last reference until termination has finished using the socket.