Re: [PATCH net v3] net/smc: fix out-of-bounds read of rkey array in SMC-Rv2 LLC processing

On Mon, 27 Jul 2026 18:58:33 +0900 Yehyeong Lee wrote:
> An SMC-Rv2 LLC message can be longer than the 44-byte union smc_llc_msg.
> If the device offers two receive SGEs, the part beyond 44 bytes is
> scattered into the link group's shared v2 buffer. If it does not
> (max_recv_sge == 1, so smc_link_shared_v2_rxbuf() is false), the whole
> message is received into the link's own receive buffer.

This should probably be a 3 patch series:

  1. the use-after-free fix in smc_llc_srv_add_link() (qentry_del ->
     qentry_clr plus the explicit kfree(qentry) on both exit paths)
  2. the new peer-count validation in smc_llc_save_add_link_rkeys() and
     smc_llc_rmt_delete_rkey()
  3. the ownership refactor of struct smc_llc_qentry and the
     smc_llc_enqueue() signature change
-- 
pw-bot: cr