D. Wythe d9cef55ed4 net/smc: fix UAF on smcsk after smc_listen_out() ... BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590 The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows: smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(sk) | smc_listen_out_connected() | | \- smc_listen_out | | | \- release_sock | | |- sk->sk_data_ready() | | fd = accept(); | close(fd); | \- socket->sk = NULL; /* newclcsock->sk is NULL now */ SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk)) Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue. Fixes: 3b2dec2603 ("net/smc: restructure client and server code in af_smc") Signed-off-by: D. Wythe <alibuda@linux.alibaba.com> Reviewed-by: Guangguan Wang <guangguan.wang@linux.alibaba.com> Reviewed-by: Alexandra Winter <wintera@linux.ibm.com> Reviewed-by: Dust Li <dust.li@linux.alibaba.com> Link: https://patch.msgid.link/20250818054618.41615-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-08-19 18:27:16 -07:00
..
Kconfig	…
Makefile	net/smc: Introduce IPPROTO_SMC	2024-06-17 13:14:09 +01:00
af_smc.c	net/smc: fix UAF on smcsk after smc_listen_out()	2025-08-19 18:27:16 -07:00
smc.h	smc: Fix various oops due to inet_sock type confusion.	2025-07-14 17:12:42 -07:00
smc_cdc.c	net/smc: adapt cursor update when sndbuf and peer DMB are merged	2024-04-30 13:24:48 +02:00
smc_cdc.h	…
smc_clc.c	net: make sk->sk_rcvtimeo lockless	2025-06-23 17:05:12 -07:00
smc_clc.h	net/smc: check smcd_v2_ext_offset when receiving proposal msg	2024-12-15 12:34:59 +00:00
smc_close.c	…
smc_close.h	…
smc_core.c	net/smc: remove unused input parameters in smc_buf_get_slot	2025-06-19 16:15:34 -07:00
smc_core.h	net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1	2024-12-12 13:50:00 +01:00
smc_diag.c	net: remove sock_i_uid()	2025-06-23 17:04:03 -07:00
smc_ib.c	net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1	2024-12-12 13:50:00 +01:00
smc_ib.h	…
smc_inet.c	net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC	2024-10-10 08:48:11 -07:00
smc_inet.h	net/smc: Introduce IPPROTO_SMC	2024-06-17 13:14:09 +01:00
smc_ism.c	…
smc_ism.h	…
smc_llc.c	net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1	2024-12-12 13:50:00 +01:00
smc_llc.h	…
smc_loopback.c	net/smc: remove unused function smc_lo_supports_v2	2025-06-21 08:26:42 -07:00
smc_loopback.h	net/smc: remove unreferenced header in smc_loopback.h file	2024-07-31 11:48:58 +01:00
smc_netlink.c	…
smc_netlink.h	…
smc_netns.h	…
smc_pnet.c	net/smc: replace strncpy with strscpy	2025-06-23 16:56:21 -07:00
smc_pnet.h	…
smc_rx.c	net/smc: fix data error when recvmsg with MSG_PEEK flag	2025-01-13 18:59:00 -08:00
smc_rx.h	net/smc: fix data error when recvmsg with MSG_PEEK flag	2025-01-13 18:59:00 -08:00
smc_stats.c	net/smc: introduce statistics for ringbufs usage of net namespace	2024-08-20 11:38:23 +02:00
smc_stats.h	net/smc: introduce statistics for ringbufs usage of net namespace	2024-08-20 11:38:23 +02:00
smc_sysctl.c	net/smc: add sysctl for smc_limit_hs	2024-09-10 12:11:04 +02:00
smc_sysctl.h	…
smc_tracepoint.c	…
smc_tracepoint.h	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
smc_tx.c	…
smc_tx.h	…
smc_wr.c	net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1	2024-12-12 13:50:00 +01:00
smc_wr.h	…