CVE-2024-56641

In the Linux kernel, the following vulnerability has been resolved:

net/smc: initialize close_work early to avoid warning

We encountered a warning that close_work was canceled before initialization.

WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0 Workqueue: events smc_lgr_terminate_work [smc] RIP: 0010:__flush_work+0x19e/0x1b0 Call Trace: ? __wake_up_common+0x7a/0x190 ? work_busy+0x80/0x80 __cancel_work_timer+0xe3/0x160 smc_close_cancel_work+0x1a/0x70 [smc] smc_close_active_abort+0x207/0x360 [smc] __smc_lgr_terminate.part.38+0xc8/0x180 [smc] process_one_work+0x19e/0x340 worker_thread+0x30/0x370 ? process_one_work+0x340/0x340 kthread+0x117/0x130 ? __kthread_cancel_work+0x50/0x50 ret_from_fork+0x22/0x30

This is because when smc_close_cancel_work is triggered, e.g. the RDMA driver is rmmod and the LGR is terminated, the conn->close_work is flushed before initialization, resulting in WARN_ON(!work->func).

_smc_lgr_terminate | smc_connect{rdma|ism}

                            | smc_conn_create
			| \- smc_lgr_register_conn

for conn in lgr->conns_all | - smc_conn_kill | - smc_close_active_abort | - smc_close_cancel_work | - cancel_work_sync | - __flush_work | (close_work) | | smc_close_init | - INIT_WORK(&close_work)

So fix this by initializing close_work before establishing the connection.

Red Hat Enterprise Linux 9 is affected by a low-severity flaw in the Linux kernel's SMC (Shared Memory Communications over RDMA) implementation. When an SMC link group is terminated while a connection is still being established -- for example, when the RDMA driver module is removed (rmmod) and the link group is terminated -- smc_close_cancel_work can call cancel_work_sync on a connection's close_work work item before smc_close_init has initialized it, causing the workqueue subsystem's __flush_work to trigger WARN_ON(!work->func) and emit a kernel WARNING. The verified consequence is limited to this kernel warning; there is no evidence of memory corruption or of any impact on confidentiality or integrity, so Red Hat rates this flaw Low severity (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). This is lower than the upstream CVE record's rating, which uses a network attack vector that the upstream fix analysis does not support: triggering the issue requires local actions such as unloading the RDMA driver, and the result is only a warning. In Red Hat Enterprise Linux 9, the kernel and kernel-rt components are affected and the fix is deferred because the issue is warning-only with no security-relevant consequence beyond a WARNING message in the kernel log; the residual risk of the deferred fix is that this warning may appear on affected systems during SMC link-group termination. Red Hat Enterprise Linux 6 and 7 are currently marked not affected for this flaw, while RHEL 8 and Hosted OpenShift streams are currently untriaged.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.