From nobody Fri Oct 2 11:43:14 2026 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33EC73E3DAB for ; Sat, 1 Aug 2026 09:42:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785577359; cv=none; b=HIdRS4GHZtI1Son2Wn8y/lL5A/Gu1sfoYHiPVxd46GCvVlboOfqUnXopoH+gyfM7AldD1OkNak5avdhMF/30pmPGz0lzy7UhyFnKQRY/yFfohlxA+7qMdaoKLlFhzMLaBkUXP7GrbUCnVYCwHNUUKEBoiyq1igbeNSSE73myKk4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785577359; c=relaxed/simple; bh=q5UEPjHCTM3HJeezdrQHBgApF6M5fV7Fh+3R+qmBDNI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fGjqjdUvXyP4DBBlMWeuuRhcI/X7tLYW8fmGxbR4JHUiC0kuL7wpouZ2lJNlnatK7hbWy9h7OicK+pUocOzx2rzEsHKzn85v0d5UIxcvLzu4ppmnHVobh63qLt6meBimz5FTNVvz3YpQcW/eFek/8VD5lYj/0Ri0E53TbEIa/YI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=RPP7wGPs; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="RPP7wGPs" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2cacb8416a1so18619275ad.1 for ; Sat, 01 Aug 2026 02:42:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1785577355; x=1786182155; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yz1oRNcg19iVfX+eVJWelaG34L/oIKLecIITUvBw3oY=; b=RPP7wGPst9eodJlskofJOoAey0kzAW7k0FnhPBzFXqfCkPn+PT4RHqTfXPCXjFickL PYcLPVA0fdap+OWhQfIgA5oQjioAQinDhJG8bs+SyVeA5mODu3RFsV5o/H2Hp0Xnp7ZW 60Fz+OyoN6+/XFF0WGKHjt3NrfU1AFZjItUdsWw+mt4xiTCM5WVArhwf0qCjONJO4sQk fbZaSxiTdqAfm/9A4YmlPVGsDDP1EIzWGCnp+Z+EAz4bvc49tPB/ZB45v3Hd58178R8K S2P/nz0+rbjW8IUmVOJXMzINA4zCDCO/+sCoTNzmmlFc/zJrAqqpiqRmvyugB++wGTuJ oDiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785577355; x=1786182155; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=yz1oRNcg19iVfX+eVJWelaG34L/oIKLecIITUvBw3oY=; b=pL/nT121+fbpxBghGRg5LdNnZlAq9DgqtNeA486X34AKU7kDIz3U3L94lZjXoFLXDv 1TQ5SIfIp0qPSwrC3cwDlFJ68NHywyf4Rvy8ynDAGo0ENwFatQwK6trTiu/aMgcgewN4 YIVpEpkI5efbXFYZ3WVZ5bCjaxhG3Pt6r3BCgt5KwM4jtUcaH1xq2Yy4shz3BJjzNyIr PT+itXGpLFGLqw9jkKdRs9CezftND5J+xV5pqcPImZEgePEq5OjIS0I6tykvw2dFZB4f GfI/55cxwtam34niEMOKis5TajoF3LrCwU+loUW7LvrbjSyxSwPtsuRiVXktDH0+jUy2 HpEw== X-Forwarded-Encrypted: i=1; AHgh+RoYaHTAF33f2/cmZYcpMgNsxvSWeJICw3pvRiMKxa1z3FP/ol4tSItnPoSq96x0gjqsTD+o/ArQX+TDW6c=@vger.kernel.org X-Gm-Message-State: AOJu0YxJiaAnS2O28h+mDfg8nTNqHuObpXMXVkTuaS5eewDhAox/qo25 oBnHAn2V5Uy9KKuzV3u+IWLA6O6ZCtd3I8jqdlTjX/pwf1H3XcYaYpMZ8ORVBzttakM= X-Gm-Gg: AR+sD13GXJYtiaVNhTKnZBNb5j44ly/+n0u8Y0jo5Q+NHo1xg6JStuSq1/nmbbA1iri ICHbld4gE6LKgYtD/Am867ltyh/qLdTAHPz7pdURNioaHzDX02ecqNoqTgCqYpQV/rXAO28ORf3 OMkXYLP58MlbnS6k7pDAwqCf//tSPsbzgtml9cpEh5vfEg5HSO9zy1iJJd8PnN7H/4HFdUHW08b bxB3O5qZVo9UG2+eenNEd6lsONd6taQFvsIl3OdIBG5l0JLfbS0p+t2eW9X8LHgYKS2nGYMrRSv xriUdfOA6u/VmH93pIVRgSWaCM2Lmt67u6LT1sSf74YOd3/OokqeTCRZlVEsJJLffYNSxCDF094 IGCB64rfkgzZxdRJ1Enq0i1c8mRPsMoVdrF6LNVkASGo7gPFS2zQdjbpQ9X0UMxqFM5v8xlPTJy 5rHUenXDPQ9IzRhsyQkA9ucXPGGWvkd8EU+gYeeMJ3r63YOiqqGrCVM2zdKFxfC1iB5I+83zsIw L393AgnhgE= X-Received: by 2002:a17:903:2442:b0:2ce:d34a:5963 with SMTP id d9443c01a7336-2d05229870amr27434675ad.24.1785577355171; Sat, 01 Aug 2026 02:42:35 -0700 (PDT) Received: from localhost.localdomain ([2406:5900:1044:110c:c329:7b28:fe02:5dc8]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d04b0eb486sm16006465ad.53.2026.08.01.02.42.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 01 Aug 2026 02:42:34 -0700 (PDT) From: Yehyeong Lee To: alibuda@linux.alibaba.com, dust.li@linux.alibaba.com, sidraya@linux.ibm.com, wenjia@linux.ibm.com, kuba@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com Cc: horms@kernel.org, mjambigi@linux.ibm.com, tonylu@linux.alibaba.com, guwen@linux.alibaba.com, guangguan.wang@linux.alibaba.com, kees@kernel.org, gustavoars@kernel.org, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-s390@vger.kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee , stable@vger.kernel.org Subject: [PATCH net v5 1/3] net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() Date: Sat, 1 Aug 2026 18:42:06 +0900 Message-ID: <20260801094208.1937951-2-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801094208.1937951-1-yhlee@isslab.korea.ac.kr> References: <20260801094208.1937951-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc =3D &qentry->msg.add_link; smc_llc.c:1482 ... smc_llc_save_add_link_info(link_new, add_llc); smc_llc.c:1494 smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); smc_llc.c:1495 ... u8 *llc_msg =3D smc_link_shared_v2_rxbuf(link) ? (u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc; smc_llc.c:1504 smc_llc_save_add_link_rkeys(link, link_new, llc_msg); smc_llc.c:1506 smc_llc_flow_qentry_del() kfree()s the entry, so on a link without a shared v2 receive buffer the pointer handed to smc_llc_save_add_link_rkeys() is already freed. Before the Fixes: commit that branch always used lgr->wr_rx_buf_v2 and add_llc was not used after the free. Detach the entry instead of freeing it there, and free it explicitly on both exit paths. The reject path has to detach as well, otherwise it would be freed twice. Fixes: 27ef6a9981fe ("net/smc: support SMC-R V2 for rdma devices with max_r= ecv_sge equals to 1") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- Reproduced on an unpatched tree over rxe, with KASAN, kasan_multi_shot and a link forced to max_recv_sge =3D=3D 1: the entry is freed and read by the sa= me call, and the freeing frame is smc_llc_srv_add_link() itself. BUG: KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys+0x333/0x350 Read of size 2 at addr ffff8880052194de by task kworker/0:1/11 Workqueue: smc_hs_wq smc_listen_work smc_llc_save_add_link_rkeys+0x333/0x350 smc_llc_srv_add_link+0xaa2/0x1e50 smc_listen_work+0x489e/0x4d00 Allocated by task 48: smc_llc_enqueue+0x72/0x560 smc_wr_rx_tasklet_fn+0x474/0xa80 Freed by task 11: kfree+0x121/0x380 smc_llc_srv_add_link+0x9a8/0x1e50 smc_listen_work+0x489e/0x4d00 The buggy address is located 94 bytes inside of freed 96-byte region [ffff888005219480, ffff8880052194e0) The offset is past the 72-byte queue entry because the out-of-bounds read fixed by the next patch is on the same line; what this patch removes is the free at smc_llc_srv_add_link+0x9a8 happening before the read at +0xaa2. net/smc/smc_llc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index 954b2ff1815c..90746cd1e29a 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -1481,7 +1481,7 @@ int smc_llc_srv_add_link(struct smc_link *link, } add_llc =3D &qentry->msg.add_link; if (add_llc->hd.flags & SMC_LLC_FLAG_ADD_LNK_REJ) { - smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); + smc_llc_flow_qentry_clr(&lgr->llc_flow_lcl); rc =3D -ENOLINK; goto out_err; } @@ -1492,7 +1492,8 @@ int smc_llc_srv_add_link(struct smc_link *link, lgr_new_t =3D SMC_LGR_ASYMMETRIC_PEER; } smc_llc_save_add_link_info(link_new, add_llc); - smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); + /* add_llc still points into qentry, so only detach it here */ + smc_llc_flow_qentry_clr(&lgr->llc_flow_lcl); =20 rc =3D smc_ib_ready_link(link_new); if (rc) @@ -1512,6 +1513,7 @@ int smc_llc_srv_add_link(struct smc_link *link, rc =3D smc_llc_srv_conf_link(link, link_new, lgr_new_t); if (rc) goto out_err; + kfree(qentry); kfree(ini); return 0; out_err: @@ -1520,6 +1522,7 @@ int smc_llc_srv_add_link(struct smc_link *link, smcr_link_clear(link_new, false); } out: + kfree(qentry); kfree(ini); if (send_req_add_link_resp) smc_llc_send_req_add_link_response(req_qentry); --=20 2.43.0 From nobody Fri Oct 2 11:43:14 2026 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 510C430D40C for ; Sat, 1 Aug 2026 09:42:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785577367; cv=none; b=IOmTm88H9nmW3n+6QKcjeniLM5CJEoiCoHdFMmUCZ5gCcAbrbU7SDWN+PIY9kMzYx/FTHtR7AX9tNUIjWpHkKVlA7ZiiNTOuZTDvnSgLEUwXCHNk8TijVENMcEfsO1LmQr3QWK8CLvYtwvbwngx5J04aF/nIenzmKYkB+79vo8A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785577367; c=relaxed/simple; bh=3IV/STm+W/PRrV+345FjQ5tyi8uXF2hJfUgM1So2Y+g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GEv+m5T3Q9YVS7cppN0KmVnj+pXxNWvmCb5yVZicwPN9D2IVo1XFn2EHBJvdVJjmLB7lWe7/Vpvgq+dEKp7zu3WBZ4gpX7oMlqrv4DJ9/px5u2tqPHbI1d21eO618Xnv2D1jaszrZgNxyVfI+4V/IT7x8z4OmTjzYFEKi9GQUd8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=doWYjHgS; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="doWYjHgS" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2ced3386430so18186415ad.1 for ; Sat, 01 Aug 2026 02:42:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1785577362; x=1786182162; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RODS9frLm1PCJomPW/GeW/0jLAoVijQ3t4Bi2Xu7P2k=; b=doWYjHgSwG5BiUGxX1vtQcmDJc483Da56xRVDq48T/pjq6l7O2QPKwGOpi2NQ7LzGX 6UTnZmJH+lBOd22LuBgTUJO5NmuwHTDgnmxE7JiuvTaOcu/R3qO6Gi+n6xvxaLhcJTYU azgH8uyHgM1R2/RhpGE7gOHFx1jqQoj5fgByALwT6nlSEqkoXbK8SiAC2rwNqD54cTNn nI4PGiUnCAY8WzgdyxQqZAufrKz2lYafAnIYv+8ShthtgQ3BoreF+gu3Ed4FYp6cJTu/ AnoDP4GueCwQj3ghUixbnWQnDuJzUdwEuPDC4BEcCHifH6dhdTveOpZ0AlG07OxJbnan cEjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785577362; x=1786182162; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=RODS9frLm1PCJomPW/GeW/0jLAoVijQ3t4Bi2Xu7P2k=; b=jUSq/NYnU2RoYMx2dm6hikgUIcVGhjPrSld33dCX9CXt3QebbASUPDGeFSNgK65PBz JTiseLP+42AeCTe8pkoRWwk12ktIVd0s/bQPI4eBj+f8oZkjieiZSxITdsvLmNChGyNi YZ34iNEMNrklNiHX2tN58Wdhfq6tDolPipgOnA6cjj56UfyODjqnT4zvFk/dUDHs8z+A nZrg4Q7QiKy8kyaHVpDpilKvkzSbEfTWIh7v87ExFsQLMDOvXzslVQSwnLNMiwKVGi90 nzrq8/9315iQCFFBR3+qvv9meEcrv2ocGwLa4LRKtAtLJ29Os7OqQlNbkv9fNZjcBV/B /fOA== X-Forwarded-Encrypted: i=1; AHgh+Rq0u0qpvuqL44A85QD9pk2/AL9btGMnU93Fvxzk5Km26sC1/5aPVTvMHy2ltTbBymp5NgqUY71/vp0z/oE=@vger.kernel.org X-Gm-Message-State: AOJu0YwmWpvqrMtGpDNnzJhXyN1l+sUSABzfSQK+204OWgRvaTDMuFqP 5JGGRpqnwnEE9YPjVD/NFAMdr3Lf+xukZxtuuD39ZXzfjlStpPd7zgxyeYLCj0rgIYk= X-Gm-Gg: AR+sD138GzF7KQVKok47yBZz+K5tPYkMOdfiAb28CW4zqlT1nz2ax6YaIP9wmZPOaUi H9jF0eyG3TYxeq/OFlPv+hyRhEl8CVnQLgh626YNgPG+roIqGicw/mik1Wp9c+xIz7Nid7bQ50h MYJClpEqwdbuZY4nhDi9HGNN5oezAAJpg49c4m5lpjPKHRBwstif77WVjIHHTmhHSi88QPclLwU PKj8jHNKumReHJLtswWlcYShGFU3cp0V/8ozmfVAQI0xGt6cRRzfvRfjfsriLa9rW6oS7tZRky4 diZfa8x4fA0bMJH2ViuUl0PtlibXrwerQ3gR5wOU5CX0hPmDIQ+EZ2renpdlbnChthTLD1+fjfF KL/8dlW/qkyd0pTCHTxs7Oy8eeBZ7pUAz52Oq0mT1PkCHPFz9DOLst8UOkNcy+DRHoyxto9BjFE uREEAtKaKtCmizKJuXq031VpPLpIz3gj5Ah9jZrWPvDh1RJXbmvhvDkInQEGuEwirx724LRu0GH 2yk1r0yTgQ= X-Received: by 2002:a17:902:ea0c:b0:2ce:9439:59a5 with SMTP id d9443c01a7336-2d0523f3cdemr30235795ad.36.1785577361938; Sat, 01 Aug 2026 02:42:41 -0700 (PDT) Received: from localhost.localdomain ([2406:5900:1044:110c:c329:7b28:fe02:5dc8]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d04b0eb486sm16006465ad.53.2026.08.01.02.42.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 01 Aug 2026 02:42:41 -0700 (PDT) From: Yehyeong Lee To: alibuda@linux.alibaba.com, dust.li@linux.alibaba.com, sidraya@linux.ibm.com, wenjia@linux.ibm.com, kuba@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com Cc: horms@kernel.org, mjambigi@linux.ibm.com, tonylu@linux.alibaba.com, guwen@linux.alibaba.com, guangguan.wang@linux.alibaba.com, kees@kernel.org, gustavoars@kernel.org, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-s390@vger.kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee , stable@vger.kernel.org Subject: [PATCH net v5 2/3] net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages Date: Sat, 1 Aug 2026 18:42:07 +0900 Message-ID: <20260801094208.1937951-3-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801094208.1937951-1-yhlee@isslab.korea.ac.kr> References: <20260801094208.1937951-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On a link whose device has max_recv_sge =3D=3D 1 there is no shared v2 rece= ive buffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44 bytes past the start of the queue entry's inline message: ext =3D (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE); The entry is a 72-byte allocation and the extension starts at offset 68, so ext->num_rkeys at offset 94 is already past it. This happens on every SMC-Rv2 link addition, whatever the peer sends: BUG: KASAN: slab-out-of-bounds in smc_llc_save_add_link_rkeys+0x333/0x350 Read of size 2 at addr ffff8880056406de by task smctest/106 Call Trace: smc_llc_save_add_link_rkeys+0x333/0x350 smc_llc_cli_add_link+0xca7/0x1e80 __smc_connect+0x3f5c/0x4980 smc_connect+0x42c/0x580 __sys_connect+0xfc/0x130 Allocated by task 44: smc_llc_enqueue+0x72/0x560 smc_wr_rx_tasklet_fn+0x474/0xa80 The buggy address is located 22 bytes to the right of allocated 72-byte region [ffff888005640680, ffff8880056406c8) Whatever that read finds then bounds the ext->rt[] loop, so a peer that declares 255 rkeys reads much further. smc_llc_rmt_delete_rkey() has the same shape for llcv2->rkey[]. Bound both loops by the buffer they read from, and skip the extension altogether when there is no shared v2 receive buffer. The extension does arrive on the link, but smc_llc_enqueue() copies only sizeof(union smc_llc_msg) into the queue entry, so what that code read past the 44 inline bytes was heap and not peer data. Fixes: 27ef6a9981fe ("net/smc: support SMC-R V2 for rdma devices with max_r= ecv_sge equals to 1") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- v4 -> v5: corrected the reason given for skipping the extension. It does arrive on the link; what is not there is the copy in the queue entry. No functional change. Measured over rxe with KASAN and max_recv_sge forced to 1, five test cells (plain 1-rkey delete, delete declaring 255, plain ADD_LINK v2, ADD_LINK declaring 255, and an SMC-Rv1 link group). Without this patch four of the five report; with it none do. With kasan_multi_shot the unpatched kernel reports 491 times in a single ADD_LINK run, the patched one not at all. net/smc/smc_llc.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index 90746cd1e29a..02561f39d6d8 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -1000,13 +1000,21 @@ static void smc_llc_save_add_link_rkeys(struct smc_= link *link, struct smc_link *link_new, u8 *llc_msg) { + const u32 rt_off =3D offsetof(struct smc_llc_msg_add_link_v2_ext, rt); struct smc_llc_msg_add_link_v2_ext *ext; struct smc_link_group *lgr =3D link->lgr; int max, i; =20 + /* Without a shared v2 receive buffer the extension is not copied + * into the queue entry, so not even ext->num_rkeys is there. + */ + if (!smc_link_shared_v2_rxbuf(link)) + return; ext =3D (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE); max =3D min_t(u8, ext->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); + max =3D min_t(u32, max, (SMC_WR_BUF_V2_SIZE - SMC_WR_TX_SIZE - rt_off) / + sizeof(ext->rt[0])); down_write(&lgr->rmbs_lock); for (i =3D 0; i < max; i++) { smc_rtoken_set(lgr, link->link_idx, link_new->link_idx, @@ -1813,17 +1821,25 @@ static void smc_llc_rmt_delete_rkey(struct smc_link= _group *lgr) link =3D qentry->link; =20 if (lgr->smc_version =3D=3D SMC_V2) { + const u32 rkey_off =3D + offsetof(struct smc_llc_msg_delete_rkey_v2, rkey); struct smc_llc_msg_delete_rkey_v2 *llcv2; + u32 buf_len; =20 if (smc_link_shared_v2_rxbuf(link)) { memcpy(lgr->wr_rx_buf_v2, llc, sizeof(*llc)); llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)lgr->wr_rx_buf_v2; + buf_len =3D SMC_WR_BUF_V2_SIZE; } else { llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)llc; + buf_len =3D sizeof(qentry->msg); } llcv2->num_inval_rkeys =3D 0; =20 max =3D min_t(u8, llcv2->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); + /* bound by the buffer llcv2 points at */ + max =3D min_t(u32, max, (buf_len - rkey_off) / + sizeof(llcv2->rkey[0])); for (i =3D 0; i < max; i++) { if (smc_rtoken_delete(link, llcv2->rkey[i])) llcv2->num_inval_rkeys++; --=20 2.43.0 From nobody Fri Oct 2 11:43:14 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 17C24401A18 for ; Sat, 1 Aug 2026 09:42:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785577375; cv=none; b=q7X8BOzDrQcCVc0yEUAep3UY8LdKS9sAa5LXUwxXBg7XeA0C7k4zdGpRAgIQHn3RkYMpGTulvv+323G6dELU9rjBtEPzH+f/MkPVizV5l09HYXVHg4MstMGTDanshOWKEQWOgjWAFjsB/y0mxx6FXVAvbBn+uemPlHDFMzs6UDg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785577375; c=relaxed/simple; bh=PAPHATrwXa+a6VT2FMKVbAILbxasMFchp8ry8/NpgTg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hdV03lVyklUmX51kiv1QarYo79TMh/mZOt4hEZyO4rp7y5/yF9+qQDWbMbJhxIFeHVKtQ+NoHDi6ihtILECz/Mt/81TDlUzyEZRh/FZscsfF5R4zP//AawWNsxEmaK0QGxRrEwZ+pEYNc3zjW1RpDbpACukxBCDJIsTkV3FC9w4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=jCdp3LtW; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="jCdp3LtW" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2d004f135b1so18712495ad.3 for ; Sat, 01 Aug 2026 02:42:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1785577370; x=1786182170; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bcm3kW0Yg5dhEINVbKpsiuNuaVNFAIkrbN5plbQL9bs=; b=jCdp3LtWbM1iMmssqhLURjtnUuji9vBxrutqnuN1AinlOI4+ORPQvUflh3JBJ97fMt lJVJUL1Mef4PpoCAd3AkI2v6hS3ruUZtmMQP30Td4SpQvpXbOmeFFhviBgUh4he2UCoD YScMFSVZBU9RbcLrpmnkQH+LEkUU+d+9TNEVAaLDDkKD9TqyN8slh4u/ywaI3puhdau0 jQhhlORv/UjFjA8pfZyQoC7qkmO3F+9+oweHXyOfgv8fCC9IUwxJOQrl3YgPd866BHqr osXeBqNV08r2rW+jjTppQ/23h+FlQ0fHqvrHUksd3CJIXm9bFBGC17pRyUZhoQASKMST AeCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785577370; x=1786182170; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bcm3kW0Yg5dhEINVbKpsiuNuaVNFAIkrbN5plbQL9bs=; b=JkYrEsV9ame3tZrI5Tk3yHxOyBTXMrPqDhEBZ/q3F9DbRv63FP4iUMtnwA/Je2YiMO 360fP//zx8MKTSVPqTPUL5c6+Sc6gOqABw17ViMqd+BkyKhfwmKD8gX6R9rwB9WTUoMs D3L9dCzGeHSJKcdhbkkHRoRgVpo3A5AIppufoo+p6GLcocY7XKIpjn2FAaduAg4D5/w1 NZEOKaxs5ThoKxjipaNVyI/VcZZOT3Trairlklqu3NO3BtNu6ilMYhMqUnS3Udw+QdgO uxvjEloVghSnh8aFeFzR6A0nL8A8B/wUr+VZNoRACDcZlO9eqlYWFCikbGXNKGjp9PQW Yq1A== X-Forwarded-Encrypted: i=1; AHgh+RqU/diT66gjH5ij4uJZpCT9iW8yZ5Q6eszfv7kK2JxGVsnp5untzX3EeRfYgvkhIAjgPvfRVin5125hVEE=@vger.kernel.org X-Gm-Message-State: AOJu0YzJlr7Zb112v2bcQHHFFuS6b8Ra73iY6s5TH/9/t+yC3sghNHVS 7G+DuoGy1udPa7954Un4X+XRsLYe2NUqK8Ew2GYqg3fYZm2ZHjCW6eZ3bYCsjEkYLSY= X-Gm-Gg: AR+sD11XyyX7WLbAlw7XgcOV1+DW3eMgAZ3XgHT0BT+6uIyih96sDUPjvfOKdxsO6IX l0wfbvA3DVFk53fpC5X7iVRqGomAVjyituTZlhd2ZA4vXkfxfrCYqLZ6XaUYO3v2SRIgMXfi4M6 wRxAmQRup3syyccUS3tHGo+EiGrjffas1mg4tfVsrObS1fJOXTn2hcnMH7YZABoClo3y1D9RsYM xfH1hn4PwNn0NFuwCGQ81X6BjKGxpPr1Ct9SIF5FhMJMIx4LIRyK5WMuTp23ZqdP/uSFk24UF3A oqQfcOVGMlHCTqieD17dTyXC0zc6PSdFc9SHVv+6EPYwwK7N6uxBRF01AyCgV2nBjQO1ifPasV+ 16lpyNpwMsDTCcKQzlwFdD4yN+/UpwC0T7pDdg5gtsCN+mhtDmijUXtg50xHCvSjE+39HYwLeEn fP36ZYlIgMZ+L6CCf5XAymYAd5vWp8trI93mKsy9DlR7I+GrLtPJJN4lthd3Z1sjNJWP+ciiq8r Pzk0PQNkxg= X-Received: by 2002:a17:903:19e6:b0:2c7:f2c6:89e0 with SMTP id d9443c01a7336-2d0521eabe6mr33621355ad.4.1785577370004; Sat, 01 Aug 2026 02:42:50 -0700 (PDT) Received: from localhost.localdomain ([2406:5900:1044:110c:c329:7b28:fe02:5dc8]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d04b0eb486sm16006465ad.53.2026.08.01.02.42.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 01 Aug 2026 02:42:49 -0700 (PDT) From: Yehyeong Lee To: alibuda@linux.alibaba.com, dust.li@linux.alibaba.com, sidraya@linux.ibm.com, wenjia@linux.ibm.com, kuba@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com Cc: horms@kernel.org, mjambigi@linux.ibm.com, tonylu@linux.alibaba.com, guwen@linux.alibaba.com, guangguan.wang@linux.alibaba.com, kees@kernel.org, gustavoars@kernel.org, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-s390@vger.kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee Subject: [PATCH net v5 3/3] net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry Date: Sat, 1 Aug 2026 18:42:08 +0900 Message-ID: <20260801094208.1937951-4-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260801094208.1937951-1-yhlee@isslab.korea.ac.kr> References: <20260801094208.1937951-1-yhlee@isslab.korea.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" An LLC message longer than the 44-byte union smc_llc_msg arrives either whole in the receive buffer or split into the link group's shared v2 buffer, and both consumers of the tail rebuild that layout themselves. Copy the tail into the queue entry instead, so its length and its lifetime are those of the message that arrived, and declare the rkeys that do fit inline as a member of the union rather than reaching them through a cast of a shorter type. The bound the previous patch placed on links without a shared v2 receive buffer is no longer needed here: the extension is read from the qentry, whose length is the length of the message that arrived. A DELETE_RKEY_V2 is now bounded by what arrived rather than by the buffer it landed in: a 44-byte message declaring 255 rkeys processed 255 of them before, and processes the 9 that fit now. Suggested-by: D. Wythe Signed-off-by: Yehyeong Lee --- Measured over rxe with KASAN: a DELETE_RKEY_V2 carrying 12 rkeys over a link with a shared v2 receive buffer round-trips all 12 values, the last three coming from the copied tail; 8, 9 and 10 rkeys and a 44-byte message declar= ing 10 give 8, 9, 10 and 9 processed rkeys respectively. kmemleak reports noth= ing over the link-addition path, and does report the queue entry when the free added by patch 1 is removed again. net/smc/smc_llc.c | 106 ++++++++++++++++++++++++++++++---------------- 1 file changed, 69 insertions(+), 37 deletions(-) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index 02561f39d6d8..1b153173dd51 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -157,6 +157,7 @@ struct smc_llc_msg_confirm_rkey { /* type 0x06 */ }; =20 #define SMC_LLC_DEL_RKEY_MAX 8 +#define SMC_LLC_DEL_RKEY_V2_INLINE 9 #define SMC_LLC_FLAG_RKEY_RETRY 0x10 #define SMC_LLC_FLAG_RKEY_NEG 0x20 =20 @@ -177,6 +178,15 @@ struct smc_llc_msg_delete_rkey_v2 { /* type 0x29 */ __be32 rkey[]; }; =20 +/* the leading rkeys of a DELETE_RKEY_V2 fit into union smc_llc_msg */ +struct smc_llc_msg_delete_rkey_v2_inline { /* type 0x29 */ + struct smc_llc_hdr hd; + u8 num_rkeys; + u8 num_inval_rkeys; + u8 reserved[2]; + __be32 rkey[SMC_LLC_DEL_RKEY_V2_INLINE]; +}; + union smc_llc_msg { struct smc_llc_msg_confirm_link confirm_link; struct smc_llc_msg_add_link add_link; @@ -186,6 +196,7 @@ union smc_llc_msg { =20 struct smc_llc_msg_confirm_rkey confirm_rkey; struct smc_llc_msg_delete_rkey delete_rkey; + struct smc_llc_msg_delete_rkey_v2_inline delete_rkey_v2; =20 struct smc_llc_msg_test_link test_link; struct { @@ -194,15 +205,23 @@ union smc_llc_msg { } raw; }; =20 +static_assert(SMC_LLC_DEL_RKEY_V2_INLINE =3D=3D + (sizeof(union smc_llc_msg) - + offsetof(struct smc_llc_msg_delete_rkey_v2, rkey)) / + sizeof(__be32)); + #define SMC_LLC_FLAG_RESP 0x80 =20 struct smc_llc_qentry { struct list_head list; struct smc_link *link; + u16 body_len; union smc_llc_msg msg; + u8 body[] __counted_by(body_len); }; =20 -static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc); +static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc, + u32 byte_len); =20 struct smc_llc_qentry *smc_llc_flow_qentry_clr(struct smc_llc_flow *flow) { @@ -998,22 +1017,19 @@ static int smc_llc_cli_conf_link(struct smc_link *li= nk, =20 static void smc_llc_save_add_link_rkeys(struct smc_link *link, struct smc_link *link_new, - u8 *llc_msg) + struct smc_llc_qentry *qentry) { const u32 rt_off =3D offsetof(struct smc_llc_msg_add_link_v2_ext, rt); struct smc_llc_msg_add_link_v2_ext *ext; struct smc_link_group *lgr =3D link->lgr; int max, i; =20 - /* Without a shared v2 receive buffer the extension is not copied - * into the queue entry, so not even ext->num_rkeys is there. - */ - if (!smc_link_shared_v2_rxbuf(link)) + /* the rkey count itself is only there if enough bytes arrived */ + if (qentry->body_len < rt_off) return; - ext =3D (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + - SMC_WR_TX_SIZE); + ext =3D (struct smc_llc_msg_add_link_v2_ext *)qentry->body; max =3D min_t(u8, ext->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); - max =3D min_t(u32, max, (SMC_WR_BUF_V2_SIZE - SMC_WR_TX_SIZE - rt_off) / + max =3D min_t(u32, max, (qentry->body_len - rt_off) / sizeof(ext->rt[0])); down_write(&lgr->rmbs_lock); for (i =3D 0; i < max; i++) { @@ -1107,9 +1123,7 @@ int smc_llc_cli_add_link(struct smc_link *link, struc= t smc_llc_qentry *qentry) if (rc) goto out_clear_lnk; if (lgr->smc_version =3D=3D SMC_V2) { - u8 *llc_msg =3D smc_link_shared_v2_rxbuf(link) ? - (u8 *)lgr->wr_rx_buf_v2 : (u8 *)llc; - smc_llc_save_add_link_rkeys(link, lnk_new, llc_msg); + smc_llc_save_add_link_rkeys(link, lnk_new, qentry); } else { rc =3D smc_llc_cli_rkey_exchange(link, lnk_new); if (rc) { @@ -1510,9 +1524,7 @@ int smc_llc_srv_add_link(struct smc_link *link, if (rc) goto out_err; if (lgr->smc_version =3D=3D SMC_V2) { - u8 *llc_msg =3D smc_link_shared_v2_rxbuf(link) ? - (u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc; - smc_llc_save_add_link_rkeys(link, link_new, llc_msg); + smc_llc_save_add_link_rkeys(link, link_new, qentry); } else { rc =3D smc_llc_srv_rkey_exchange(link, link_new); if (rc) @@ -1563,7 +1575,8 @@ void smc_llc_add_link_local(struct smc_link *link) add_llc.hd.common.llc_type =3D SMC_LLC_ADD_LINK; smc_llc_init_msg_hdr(&add_llc.hd, link->lgr, sizeof(add_llc)); /* no dev and port needed */ - smc_llc_enqueue(link, (union smc_llc_msg *)&add_llc); + smc_llc_enqueue(link, (union smc_llc_msg *)&add_llc, + sizeof(union smc_llc_msg)); } =20 /* worker to process an add link message */ @@ -1599,7 +1612,8 @@ void smc_llc_srv_delete_link_local(struct smc_link *l= ink, u8 del_link_id) del_llc.link_num =3D del_link_id; del_llc.reason =3D htonl(SMC_LLC_DEL_LOST_PATH); del_llc.hd.flags |=3D SMC_LLC_FLAG_DEL_LINK_ORDERLY; - smc_llc_enqueue(link, (union smc_llc_msg *)&del_llc); + smc_llc_enqueue(link, (union smc_llc_msg *)&del_llc, + sizeof(union smc_llc_msg)); } =20 static void smc_llc_process_cli_delete_link(struct smc_link_group *lgr) @@ -1821,27 +1835,28 @@ static void smc_llc_rmt_delete_rkey(struct smc_link= _group *lgr) link =3D qentry->link; =20 if (lgr->smc_version =3D=3D SMC_V2) { - const u32 rkey_off =3D - offsetof(struct smc_llc_msg_delete_rkey_v2, rkey); - struct smc_llc_msg_delete_rkey_v2 *llcv2; - u32 buf_len; - - if (smc_link_shared_v2_rxbuf(link)) { - memcpy(lgr->wr_rx_buf_v2, llc, sizeof(*llc)); - llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)lgr->wr_rx_buf_v2; - buf_len =3D SMC_WR_BUF_V2_SIZE; - } else { - llcv2 =3D (struct smc_llc_msg_delete_rkey_v2 *)llc; - buf_len =3D sizeof(qentry->msg); - } + struct smc_llc_msg_delete_rkey_v2_inline *llcv2; + + /* The leading SMC_LLC_DEL_RKEY_V2_INLINE rkeys are declared in + * the message itself, any further ones were received into + * qentry->body. + */ + llcv2 =3D &qentry->msg.delete_rkey_v2; llcv2->num_inval_rkeys =3D 0; =20 max =3D min_t(u8, llcv2->num_rkeys, SMC_LLC_RKEYS_PER_MSG_V2); - /* bound by the buffer llcv2 points at */ - max =3D min_t(u32, max, (buf_len - rkey_off) / - sizeof(llcv2->rkey[0])); + max =3D min_t(u32, max, SMC_LLC_DEL_RKEY_V2_INLINE + + qentry->body_len / sizeof(__be32)); for (i =3D 0; i < max; i++) { - if (smc_rtoken_delete(link, llcv2->rkey[i])) + __be32 rkey; + + if (i < SMC_LLC_DEL_RKEY_V2_INLINE) + rkey =3D llcv2->rkey[i]; + else + memcpy(&rkey, qentry->body + + (i - SMC_LLC_DEL_RKEY_V2_INLINE) * + sizeof(rkey), sizeof(rkey)); + if (smc_rtoken_delete(link, rkey)) llcv2->num_inval_rkeys++; } memset(&llc->rkey[0], 0, sizeof(llc->rkey)); @@ -2082,18 +2097,35 @@ static void smc_llc_rx_response(struct smc_link *li= nk, wake_up(&link->lgr->llc_msg_waiter); } =20 -static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc) +static void smc_llc_enqueue(struct smc_link *link, union smc_llc_msg *llc, + u32 byte_len) { struct smc_link_group *lgr =3D link->lgr; struct smc_llc_qentry *qentry; unsigned long flags; + u16 body_len =3D 0; =20 - qentry =3D kmalloc_obj(*qentry, GFP_ATOMIC); + /* V2 messages can be longer than the inline union smc_llc_msg. Carry + * the remainder in the qentry itself, so that its lifetime and its + * length match the message the peer actually sent. + */ + if (lgr->smc_version =3D=3D SMC_V2 && byte_len > SMC_WR_TX_SIZE) + body_len =3D min_t(u32, byte_len, SMC_WR_BUF_V2_SIZE) - + SMC_WR_TX_SIZE; + + qentry =3D kmalloc_flex(*qentry, body, body_len, GFP_ATOMIC); if (!qentry) return; + qentry->body_len =3D body_len; qentry->link =3D link; INIT_LIST_HEAD(&qentry->list); memcpy(&qentry->msg, llc, sizeof(union smc_llc_msg)); + if (body_len) { + u8 *src =3D smc_link_shared_v2_rxbuf(link) ? + (u8 *)lgr->wr_rx_buf_v2 : (u8 *)llc; + + memcpy(qentry->body, src + SMC_WR_TX_SIZE, body_len); + } =20 /* process responses immediately */ if ((llc->raw.hdr.flags & SMC_LLC_FLAG_RESP) && @@ -2125,7 +2157,7 @@ static void smc_llc_rx_handler(struct ib_wc *wc, void= *buf) return; /* invalid message */ } =20 - smc_llc_enqueue(link, llc); + smc_llc_enqueue(link, llc, wc->byte_len); } =20 /***************************** worker, utils *****************************= ****/ --=20 2.43.0