{"id":70178,"date":"2025-09-15T18:32:45","date_gmt":"2025-09-15T15:02:45","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2023-53233-net-smc-fix-deadlock-triggered-by-cancel_delayed_work_syn\/"},"modified":"2025-09-15T18:32:45","modified_gmt":"2025-09-15T15:02:45","slug":"cve-2023-53233-net-smc-fix-deadlock-triggered-by-cancel_delayed_work_syn","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2023-53233-net-smc-fix-deadlock-triggered-by-cancel_delayed_work_syn\/","title":{"rendered":"CVE-2023-53233 – net\/smc: fix deadlock triggered by cancel_delayed_work_syn()"},"content":{"rendered":"

CVE ID : <\/strong>CVE-2023-53233
\n
\nPublished : <\/strong> Sept. 15, 2025, 2:22 p.m. | 32\u00a0minutes ago
\n
\nDescription : <\/strong>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n

net\/smc: fix deadlock triggered by cancel_delayed_work_syn()<\/p>\n

The following LOCKDEP was detected:
\n\t\tWorkqueue: events smc_lgr_free_work [smc]\n\t\tWARNING: possible circular locking dependency detected
\n\t\t6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted
\n\t\t——————————————————
\n\t\tkworker\/3:0\/176251 is trying to acquire lock:
\n\t\t00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0},
\n\t\t\tat: __flush_workqueue+0x7a\/0x4f0
\n\t\tbut task is already holding lock:
\n\t\t0000037fffe97dc8 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0},
\n\t\t\tat: process_one_work+0x232\/0x730
\n\t\twhich lock already depends on the new lock.
\n\t\tthe existing dependency chain (in reverse order) is:
\n\t\t-> #4 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}:
\n\t\t __lock_acquire+0x58e\/0xbd8
\n\t\t lock_acquire.part.0+0xe2\/0x248
\n\t\t lock_acquire+0xac\/0x1c8
\n\t\t __flush_work+0x76\/0xf0
\n\t\t __cancel_work_timer+0x170\/0x220
\n\t\t __smc_lgr_terminate.part.0+0x34\/0x1c0 [smc]\n\t\t smc_connect_rdma+0x15e\/0x418 [smc]\n\t\t __smc_connect+0x234\/0x480 [smc]\n\t\t smc_connect+0x1d6\/0x230 [smc]\n\t\t __sys_connect+0x90\/0xc0
\n\t\t __do_sys_socketcall+0x186\/0x370
\n\t\t __do_syscall+0x1da\/0x208
\n\t\t system_call+0x82\/0xb0
\n\t\t-> #3 (smc_client_lgr_pending){+.+.}-{3:3}:
\n\t\t __lock_acquire+0x58e\/0xbd8
\n\t\t lock_acquire.part.0+0xe2\/0x248
\n\t\t lock_acquire+0xac\/0x1c8
\n\t\t __mutex_lock+0x96\/0x8e8
\n\t\t mutex_lock_nested+0x32\/0x40
\n\t\t smc_connect_rdma+0xa4\/0x418 [smc]\n\t\t __smc_connect+0x234\/0x480 [smc]\n\t\t smc_connect+0x1d6\/0x230 [smc]\n\t\t __sys_connect+0x90\/0xc0
\n\t\t __do_sys_socketcall+0x186\/0x370
\n\t\t __do_syscall+0x1da\/0x208
\n\t\t system_call+0x82\/0xb0
\n\t\t-> #2 (sk_lock-AF_SMC){+.+.}-{0:0}:
\n\t\t __lock_acquire+0x58e\/0xbd8
\n\t\t lock_acquire.part.0+0xe2\/0x248
\n\t\t lock_acquire+0xac\/0x1c8
\n\t\t lock_sock_nested+0x46\/0xa8
\n\t\t smc_tx_work+0x34\/0x50 [smc]\n\t\t process_one_work+0x30c\/0x730
\n\t\t worker_thread+0x62\/0x420
\n\t\t kthread+0x138\/0x150
\n\t\t __ret_from_fork+0x3c\/0x58
\n\t\t ret_from_fork+0xa\/0x40
\n\t\t-> #1 ((work_completion)(&(&smc->conn.tx_work)->work)){+.+.}-{0:0}:
\n\t\t __lock_acquire+0x58e\/0xbd8
\n\t\t lock_acquire.part.0+0xe2\/0x248
\n\t\t lock_acquire+0xac\/0x1c8
\n\t\t process_one_work+0x2bc\/0x730
\n\t\t worker_thread+0x62\/0x420
\n\t\t kthread+0x138\/0x150
\n\t\t __ret_from_fork+0x3c\/0x58
\n\t\t ret_from_fork+0xa\/0x40
\n\t\t-> #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}:
\n\t\t check_prev_add+0xd8\/0xe88
\n\t\t validate_chain+0x70c\/0xb20
\n\t\t __lock_acquire+0x58e\/0xbd8
\n\t\t lock_acquire.part.0+0xe2\/0x248
\n\t\t lock_acquire+0xac\/0x1c8
\n\t\t __flush_workqueue+0xaa\/0x4f0
\n\t\t drain_workqueue+0xaa\/0x158
\n\t\t destroy_workqueue+0x44\/0x2d8
\n\t\t smc_lgr_free+0x9e\/0xf8 [smc]\n\t\t process_one_work+0x30c\/0x730
\n\t\t worker_thread+0x62\/0x420
\n\t\t kthread+0x138\/0x150
\n\t\t __ret_from_fork+0x3c\/0x58
\n\t\t ret_from_fork+0xa\/0x40
\n\t\tother info that might help us debug this:
\n\t\tChain exists of:
\n\t\t (wq_completion)smc_tx_wq-00000000#2
\n\t \t –> smc_client_lgr_pending
\n\t\t –> (work_completion)(&(&lgr->free_work)->work)
\n\t\t Possible unsafe locking scenario:
\n\t\t CPU0 CPU1
\n\t\t —- —-
\n\t\t lock((work_completion)(&(&lgr->free_work)->work));
\n\t\t lock(smc_client_lgr_pending);
\n\t\t lock((work_completion)
\n\t\t\t\t\t(&(&lgr->free_work)->work));
\n\t\t lock((wq_completion)smc_tx_wq-00000000#2);
\n\t\t *** DEADLOCK ***
\n\t\t2 locks held by kworker\/3:0\/176251:
\n\t\t #0: 0000000080183548
\n\t\t\t((wq_completion)events){+.+.}-{0:0},
\n\t\t\t\tat: process_one_work+0x232\/0x730
\n\t\t #1: 0000037fffe97dc8
\n\t\t\t((work_completion)
\n\t\t\t (&(&lgr->free_work)->work)){+.+.}-{0:0},
\n\t\t\t\tat: process_one_work+0x232\/0x730
\n\t\tstack backtr
\n—truncated—
\n
\nSeverity:<\/strong> 0.0 | NA
\n
\nVisit the link for more details, such as CVSS details, affected products, timeline, and more…<\/p>\n","protected":false},"excerpt":{"rendered":"

CVE ID : CVE-2023-53233 Published : Sept. 15, 2025, 2:22 p.m. | 32\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: net\/smc: fix deadlock triggered by cancel_delayed_work_syn() The following LOCKDEP was detected: Workqueue: events smc_lgr_free_work [smc] WARNING: possible circular locking dependency detected 6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted —————————————————— kworker\/3:0\/176251 is trying …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-70178","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=70178"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70178\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=70178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=70178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=70178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}