linux-kernel - Re: [PATCH net v2 2/2] net/smc: fix LGR and link use-after-free issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <227ce73e-a4f9-4b97-a137-f3a6472bf07f@linux.ibm.com>
Date: Fri, 29 Nov 2024 14:28:37 +0100
From: Alexandra Winter <wintera@...ux.ibm.com>
To: Wen Gu <guwen@...ux.alibaba.com>, wenjia@...ux.ibm.com, jaka@...ux.ibm.com,
        davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        pabeni@...hat.com
Cc: alibuda@...ux.alibaba.com, tonylu@...ux.alibaba.com, horms@...nel.org,
        kgraul@...ux.ibm.com, hwippel@...ux.ibm.com,
        linux-rdma@...r.kernel.org, linux-s390@...r.kernel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net v2 2/2] net/smc: fix LGR and link use-after-free issue



On 27.11.24 14:30, Wen Gu wrote:
>  net/smc/af_smc.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index ed6d4d520bc7..9e6c69d18581 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -1900,6 +1900,7 @@ static void smc_listen_out(struct smc_sock *new_smc)
>  	if (tcp_sk(new_smc->clcsock->sk)->syn_smc)
>  		atomic_dec(&lsmc->queued_smc_hs);
>  
> +	release_sock(newsmcsk); /* lock in smc_listen_work() */
>  	if (lsmc->sk.sk_state == SMC_LISTEN) {
>  		lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
>  		smc_accept_enqueue(&lsmc->sk, newsmcsk);
> @@ -2421,6 +2422,7 @@ static void smc_listen_work(struct work_struct *work)
>  	u8 accept_version;
>  	int rc = 0;
>  
> +	lock_sock(&new_smc->sk); /* release in smc_listen_out() */
>  	if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN)
>  		return smc_listen_out_err(new_smc);
>  

As far as I can tell, this looks good to me.
Unfortunately I don't understand the dependencies between the different SMC sockets and TCP sockets
well enough to give an R-b.