On Mon, 27 Jul 2026 18:58:33 +0900 Yehyeong Lee wrote:
> An SMC-Rv2 LLC message can be longer than the 44-byte union smc_llc_msg.
> If the device offers two receive SGEs, the part beyond 44 bytes is
> scattered into the link group's shared v2 buffer. If it does not
> (max_recv_sge == 1, so smc_link_shared_v2_rxbuf() is false), the whole
> message is received into the link's own receive buffer.
This should probably be a 3 patch series:
1. the use-after-free fix in smc_llc_srv_add_link() (qentry_del ->
qentry_clr plus the explicit kfree(qentry) on both exit paths)
2. the new peer-count validation in smc_llc_save_add_link_rkeys() and
smc_llc_rmt_delete_rkey()
3. the ownership refactor of struct smc_llc_qentry and the
smc_llc_enqueue() signature change
--
pw-bot: cr
