[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <052a9a59-b555-4867-9ec6-c6fa719adb61@linux.dev>
Date: Tue, 1 Apr 2025 15:31:57 +0200
From: Zhu Yanjun <yanjun.zhu@...ux.dev>
To: Paolo Abeni <pabeni@...hat.com>, Wang Liang <wangliang74@...wei.com>,
wenjia@...ux.ibm.com, jaka@...ux.ibm.com, alibuda@...ux.alibaba.com,
tonylu@...ux.alibaba.com, guwen@...ux.alibaba.com, davem@...emloft.net,
edumazet@...gle.com, kuba@...nel.org, horms@...nel.org,
ubraun@...ux.vnet.ibm.com
Cc: yuehaibing@...wei.com, zhangchangzhong@...wei.com,
linux-rdma@...r.kernel.org, linux-s390@...r.kernel.org,
netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net/smc: fix general protection fault in
__smc_diag_dump
On 01.04.25 13:01, Paolo Abeni wrote:
> On 3/31/25 10:10 AM, Wang Liang wrote:
>> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
>> index 3e6cb35baf25..454801188514 100644
>> --- a/net/smc/af_smc.c
>> +++ b/net/smc/af_smc.c
>> @@ -371,6 +371,7 @@ void smc_sk_init(struct net *net, struct sock *sk, int protocol)
>> sk->sk_protocol = protocol;
>> WRITE_ONCE(sk->sk_sndbuf, 2 * READ_ONCE(net->smc.sysctl_wmem));
>> WRITE_ONCE(sk->sk_rcvbuf, 2 * READ_ONCE(net->smc.sysctl_rmem));
>> + smc->clcsock = NULL;
>> INIT_WORK(&smc->tcp_listen_work, smc_tcp_listen_work);
>> INIT_WORK(&smc->connect_work, smc_connect_work);
>> INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
>
> The syzkaller report has a few reproducers, have you tested this? AFAICS
> the smc socket is already zeroed on allocation by sk_alloc().
Yes. I also agree with you that smc socket should have already been zeroed.
Currently in this commit, this member variable is set to NULL
explicitly. I am not sure if this can fix this problem or not.
Based on the following, it seems that this problem can be reproduced.
"
syzbot has tested the proposed patch but the reproducer is still
triggering an issue:
general protection fault in __smc_diag_dump
"
Thus follow the instructions in this link to make tests.
https://groups.google.com/g/syzkaller-bugs/c/YwENRImdcsk/m/wBJo6qGiCAAJ?pli=1,
the following can trigger the reproducer.
"
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
"
Zhu Yanjun
>
> /P
>
Powered by blists - more mailing lists