Commit 61cb282fe97b for kernel

commit 61cb282fe97b3b0ba32ca09417a693162bf4ae3f
Author: Sidraya Jayagond <sidraya@linux.ibm.com>
Date:   Tue Sep 22 09:31:49 2026 +0200

    net/smc: fix UAF on lgr list traversal in smcr_port_err()

    smcr_port_err() traverses smc_lgr_list.list without holding
    smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
    to free an lgr while it is still being dereferenced.

    Hold smc_lgr_list.lock across the traversal. Update
    smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

    Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
    Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
    Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>
    Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
    Link: https://patch.msgid.link/20260922073149.474762-1-sidraya@linux.ibm.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 04aedd957543..9974149659c2 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1849,6 +1849,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
 	struct smc_link_group *lgr, *n;
 	int i;

+	spin_lock_bh(&smc_lgr_list.lock);
 	list_for_each_entry_safe(lgr, n, &smc_lgr_list.list, list) {
 		if (strncmp(smcibdev->pnetid[ibport - 1], lgr->pnet_id,
 			    SMC_MAX_PNETID_LEN))
@@ -1863,6 +1864,7 @@ void smcr_port_err(struct smc_ib_device *smcibdev, u8 ibport)
 				smcr_link_down_cond_sched(lnk);
 		}
 	}
+	spin_unlock_bh(&smc_lgr_list.lock);
 }

 static void smc_link_down_work(struct work_struct *work)
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index 9bb495707445..daaa8a72da90 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -333,6 +333,7 @@ static bool smc_ib_check_link_gid(u8 gid[SMC_GID_SIZE], bool smcrv2,
 static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
 {
 	struct smc_link_group *lgr;
+	bool stale_gid = false;
 	int i;

 	spin_lock_bh(&smc_lgr_list.lock);
@@ -348,11 +349,16 @@ static void smc_ib_gid_check(struct smc_ib_device *smcibdev, u8 ibport)
 				continue;
 			if (!smc_ib_check_link_gid(lgr->lnk[i].gid,
 						   lgr->smc_version == SMC_V2,
-						   smcibdev, ibport))
-				smcr_port_err(smcibdev, ibport);
+						   smcibdev, ibport)) {
+				stale_gid = true;
+				goto out;
+			}
 		}
 	}
+out:
 	spin_unlock_bh(&smc_lgr_list.lock);
+	if (stale_gid)
+		smcr_port_err(smcibdev, ibport);
 }

 static int smc_ib_remember_port_attr(struct smc_ib_device *smcibdev, u8 ibport)