linux-kernel - Re: [syzbot] [rdma?] WARNING in rxe_skb_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250626225210.1924-1-hdanton@sina.com>
Date: Fri, 27 Jun 2025 06:52:09 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+8425ccfb599521edb153@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor

> Date: Thu, 26 Jun 2025 13:55:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    ee88bddf7f2f Merge tag 'bpf-fixes' of git://git.kernel.org..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14367182580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10e9008c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10c12f0c580000

#syz test

--- x/drivers/infiniband/sw/rxe/rxe_net.c
+++ y/drivers/infiniband/sw/rxe/rxe_net.c
@@ -471,6 +471,7 @@ struct sk_buff *rxe_init_packet(struct r
 	struct net_device *ndev;
 	const struct ib_gid_attr *attr;
 	const int port_num = 1;
+	struct rxe_dev *rdev;
 
 	attr = rdma_get_gid_attr(&rxe->ib_dev, port_num, av->grh.sgid_index);
 	if (IS_ERR(attr))
@@ -503,6 +504,17 @@ struct sk_buff *rxe_init_packet(struct r
 	skb->dev	= ndev;
 	rcu_read_unlock();
 
+	rdev = rxe_get_dev_from_net(ndev);
+	if (!rdev && is_vlan_dev(ndev))
+		rdev = rxe_get_dev_from_net(vlan_dev_real_dev(ndev));
+	if (rdev)
+		ib_device_put(&rdev->ib_dev);
+	if (rdev != rxe) {
+		kfree_skb(skb);
+		skb = NULL;
+		goto out;
+	}
+
 	if (av->network_type == RXE_NETWORK_TYPE_IPV4)
 		skb->protocol = htons(ETH_P_IP);
 	else
--