linux-kernel - Re: [syzbot] Re: [syzbot] [net?] [s390?] general protection fault in smc_diag_dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0000000000002488c5061f865c65@google.com>
Date: Mon, 12 Aug 2024 18:16:32 -0700
From: syzbot <syzbot+f69bfae0a4eb29976e44@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] Re: [syzbot] [net?] [s390?] general protection fault in smc_diag_dump_proto

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: [syzbot] [net?] [s390?] general protection fault in smc_diag_dump_proto
Author: aha310510@...il.com

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

---
net/smc/smc.h      | 19 ++++++++++---------
net/smc/smc_inet.c | 24 +++++++++++++++---------
2 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/net/smc/smc.h b/net/smc/smc.h
index 34b781e463c4..f4d9338b5ed5 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -284,15 +284,6 @@ struct smc_connection {

struct smc_sock {                /* smc sock container */
   struct sock        sk;
-    struct socket        *clcsock;    /* internal tcp socket */
-    void            (*clcsk_state_change)(struct sock *sk);
-                        /* original stat_change fct. */
-    void            (*clcsk_data_ready)(struct sock *sk);
-                        /* original data_ready fct. */
-    void            (*clcsk_write_space)(struct sock *sk);
-                        /* original write_space fct. */
-    void            (*clcsk_error_report)(struct sock *sk);
-                        /* original error_report fct. */
   struct smc_connection    conn;        /* smc connection */
   struct smc_sock        *listen_smc;    /* listen parent */
   struct work_struct    connect_work;    /* handle non-blocking connect*/
@@ -325,6 +316,16 @@ struct smc_sock {                /* smc sock container */
                       /* protects clcsock of a listen
                        * socket
                        * */
+    struct socket        *clcsock;    /* internal tcp socket */
+    void            (*clcsk_state_change)(struct sock *sk);
+                        /* original stat_change fct. */
+    void            (*clcsk_data_ready)(struct sock *sk);
+                        /* original data_ready fct. */
+    void            (*clcsk_write_space)(struct sock *sk);
+                        /* original write_space fct. */
+    void            (*clcsk_error_report)(struct sock *sk);
+                        /* original error_report fct. */
+
};

#define smc_sk(ptr) container_of_const(ptr, struct smc_sock, sk)
diff --git a/net/smc/smc_inet.c b/net/smc/smc_inet.c
index bece346dd8e9..3c54faef6042 100644
--- a/net/smc/smc_inet.c
+++ b/net/smc/smc_inet.c
@@ -60,16 +60,22 @@ static struct inet_protosw smc_inet_protosw = {
};

#if IS_ENABLED(CONFIG_IPV6)
+struct smc6_sock {
+    struct smc_sock smc;
+    struct ipv6_pinfo np;
+};
+
static struct proto smc_inet6_prot = {
-    .name        = "INET6_SMC",
-    .owner        = THIS_MODULE,
-    .init        = smc_inet_init_sock,
-    .hash        = smc_hash_sk,
-    .unhash        = smc_unhash_sk,
-    .release_cb    = smc_release_cb,
-    .obj_size    = sizeof(struct smc_sock),
-    .h.smc_hash    = &smc_v6_hashinfo,
-    .slab_flags    = SLAB_TYPESAFE_BY_RCU,
+    .name               = "INET6_SMC",
+    .owner               = THIS_MODULE,
+    .init               = smc_inet_init_sock,
+    .hash               = smc_hash_sk,
+    .unhash               = smc_unhash_sk,
+    .release_cb           = smc_release_cb,
+    .obj_size           = sizeof(struct smc6_sock),
+    .h.smc_hash           = &smc_v6_hashinfo,
+    .slab_flags           = SLAB_TYPESAFE_BY_RCU,
+    .ipv6_pinfo_offset = offsetof(struct smc6_sock, np),
};

static const struct proto_ops smc_inet6_stream_ops = {
--