Wen Gu

The issue concerns the Linux kernel, specifically the net/smc component. When receiving a proposal message in the server, the fields `iparea offset` and `ipv6 prefixes cnt` from the remote client are not fully trusted. If the `iparea offset` exceeds its maximum value, it may lead to accessing the wrong address, potentially causing a crash. The patch addresses this by checking `iparea offset` and `ipv6 prefixes cnt` before using them.

A use-after-free issue was encountered in the Linux kernel, specifically in the net/smc component. This issue manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. The problem is caused by repeated release of LGR/link refcnt, potentially due to smc conn free() being called repeatedly without sock lock protection.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a refcount leak in the `smc ib find route()` function, which may cause the disclosure of confidential information. The leak occurs because the neighbour found by `neigh lookup()` and the rtable resolved by `ip route output flow()` are not released or put before return. This may lead to a refcount leak. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A crash was found when dumping SMC-D connections in the Linux kernel. The issue can be reproduced by running a specific test and continuously dumping SMC-D connections in parallel. The crash is caused by a kernel NULL pointer dereference, which occurs when the connection is in the process of being established and the `rmb desc` has not yet been initialized. The vulnerability can be exploited to cause a denial of service.

The issue is related to a kernel NULL pointer dereference in the `smc setsockopt()` function, caused by accessing `smc->clcsock` after it has been released. This can lead to a crash. The problem is addressed by holding `clcsock release lock` and checking whether `clcsock` has already been released before access. The patch also checks `smc->clcsock` in `smc getsockopt()` and `smc switch to fallback()` to prevent similar crashes.

A race condition in the `net/smc` component can lead to a kernel panic and denial of service. The issue occurs when the `smc cdc tx handler()` function attempts to access `smc sock` after it has already been freed by the `smc release()` function. This use-after-free scenario happens because `smc release()` may dismiss and release the socket before `smc cdc tx handler()` completes its access, despite initial checks for the connection's existence.