superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/net/smc
History
Wang Liang f584239a9e net/smc: fix general protection fault in __smc_diag_dump 
The syzbot report a crash:

  Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a0000003: 0000 [#1] SMP KASAN NOPTI
  KASAN: maybe wild-memory-access in range [0xdead4ead00000018-0xdead4ead0000001f]
  CPU: 1 UID: 0 PID: 6949 Comm: syz.0.335 Not tainted syzkaller #0 PREEMPT(full)
  Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
  RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline]
  RIP: 0010:__smc_diag_dump.constprop.0+0x3ca/0x2550 net/smc/smc_diag.c:89
  Call Trace:
   <TASK>
   smc_diag_dump_proto+0x26d/0x420 net/smc/smc_diag.c:217
   smc_diag_dump+0x27/0x90 net/smc/smc_diag.c:234
   netlink_dump+0x539/0xd30 net/netlink/af_netlink.c:2327
   __netlink_dump_start+0x6d6/0x990 net/netlink/af_netlink.c:2442
   netlink_dump_start include/linux/netlink.h:341 [inline]
   smc_diag_handler_dump+0x1f9/0x240 net/smc/smc_diag.c:251
   __sock_diag_cmd net/core/sock_diag.c:249 [inline]
   sock_diag_rcv_msg+0x438/0x790 net/core/sock_diag.c:285
   netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552
   netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
   netlink_unicast+0x5a7/0x870 net/netlink/af_netlink.c:1346
   netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896
   sock_sendmsg_nosec net/socket.c:714 [inline]
   __sock_sendmsg net/socket.c:729 [inline]
   ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614
   ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
   __sys_sendmsg+0x16d/0x220 net/socket.c:2700
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

The process like this:

               (CPU1)              |             (CPU2)
  ---------------------------------|-------------------------------
  inet_create()                    |
    // init clcsock to NULL        |
    sk = sk_alloc()                |
                                   |
    // unexpectedly change clcsock |
    inet_init_csk_locks()          |
                                   |
    // add sk to hash table        |
    smc_inet_init_sock()           |
      smc_sk_init()                |
        smc_hash_sk()              |
                                   | // traverse the hash table
                                   | smc_diag_dump_proto
                                   |   __smc_diag_dump()
                                   |     // visit wrong clcsock
                                   |     smc_diag_msg_common_fill()
    // alloc clcsock               |
    smc_create_clcsk               |
      sock_create_kern             |

With CONFIG_DEBUG_LOCK_ALLOC=y, the smc->clcsock is unexpectedly changed
in inet_init_csk_locks(). The INET_PROTOSW_ICSK flag is no need by smc,
just remove it.

After removing the INET_PROTOSW_ICSK flag, this patch alse revert
commit 6fd27ea183 ("net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC")
to avoid casting smc_sock to inet_connection_sock.

Reported-by: syzbot+f775be4458668f7d220e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f775be4458668f7d220e
Tested-by: syzbot+f775be4458668f7d220e@syzkaller.appspotmail.com
Fixes: d25a92ccae ("net/smc: Introduce IPPROTO_SMC")
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Link: https://patch.msgid.link/20251017024827.3137512-1-wangliang74@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		2025-10-20 17:46:06 -07:00
..
Kconfig dibs: Move event handling to dibs layer 2025-09-23 11:13:22 +02:00
Makefile dibs: Move data path to dibs layer 2025-09-23 11:13:22 +02:00
af_smc.c dibs: Define dibs_client_ops and dibs_dev_ops 2025-09-23 11:13:22 +02:00
smc.h smc: Fix various oops due to inet_sock type confusion. 2025-07-14 17:12:42 -07:00
smc_cdc.c net/smc: adapt cursor update when sndbuf and peer DMB are merged 2024-04-30 13:24:48 +02:00
smc_cdc.h
…
smc_clc.c dibs: Local gid for dibs devices 2025-09-23 11:13:22 +02:00
smc_clc.h net/smc: check smcd_v2_ext_offset when receiving proposal msg 2024-12-15 12:34:59 +00:00
smc_close.c net/smc: put sk reference if close work was canceled 2023-11-06 10:01:07 +00:00
smc_close.h
…
smc_core.c dibs: Local gid for dibs devices 2025-09-23 11:13:22 +02:00
smc_core.h net/smc: Decouple sf and attached send_buf in smc_loopback 2025-09-23 11:13:21 +02:00
smc_diag.c dibs: Local gid for dibs devices 2025-09-23 11:13:22 +02:00
smc_ib.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-09-04 13:33:00 -07:00
smc_ib.h net/smc: fix smc clc failed issue when netdevice not in init_net 2023-10-13 16:52:02 -07:00
smc_inet.c net/smc: fix general protection fault in __smc_diag_dump 2025-10-20 17:46:06 -07:00
smc_inet.h net/smc: Introduce IPPROTO_SMC 2024-06-17 13:14:09 +01:00
smc_ism.c dibs: Move event handling to dibs layer 2025-09-23 11:13:22 +02:00
smc_ism.h dibs: Move data path to dibs layer 2025-09-23 11:13:22 +02:00
smc_llc.c net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1 2024-12-12 13:50:00 +01:00
smc_llc.h
…
smc_netlink.c
…
smc_netlink.h
…
smc_netns.h
…
smc_pnet.c dibs: Create class dibs 2025-09-23 11:13:22 +02:00
smc_pnet.h
…
smc_rx.c net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-01-13 18:59:00 -08:00
smc_rx.h net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-01-13 18:59:00 -08:00
smc_stats.c net/smc: introduce statistics for ringbufs usage of net namespace 2024-08-20 11:38:23 +02:00
smc_stats.h net/smc: introduce statistics for ringbufs usage of net namespace 2024-08-20 11:38:23 +02:00
smc_sysctl.c net/smc: add sysctl for smc_limit_hs 2024-09-10 12:11:04 +02:00
smc_sysctl.h net/smc: add sysctl for max conns per lgr for SMC-R v2.1 2023-11-24 12:13:14 +00:00
smc_tracepoint.c
…
smc_tracepoint.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
smc_tx.c net/smc: Decouple sf and attached send_buf in smc_loopback 2025-09-23 11:13:21 +02:00
smc_tx.h smc: Drop smc_sendpage() in favour of smc_sendmsg() + MSG_SPLICE_PAGES 2023-06-24 15:50:12 -07:00
smc_wr.c net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1 2024-12-12 13:50:00 +01:00
smc_wr.h
…