[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250629132933.33599-1-contact@arnaud-lcm.com>
Date: Sun, 29 Jun 2025 14:29:32 +0100
From: Arnaud Lecomte <contact@...aud-lcm.com>
To: syzbot+827ae2bfb3a3529333e9@...kaller.appspotmail.com
Cc: agordeev@...ux.ibm.com,
alibuda@...ux.alibaba.com,
davem@...emloft.net,
edumazet@...gle.com,
guwen@...ux.alibaba.com,
horms@...nel.org,
jaka@...ux.ibm.com,
kuba@...nel.org,
linux-kernel@...r.kernel.org,
linux-rdma@...r.kernel.org,
linux-s390@...r.kernel.org,
netdev@...r.kernel.org,
pabeni@...hat.com,
syzkaller-bugs@...glegroups.com,
tonylu@...ux.alibaba.com,
wenjia@...ux.ibm.com
Subject: syztest
#syz test
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -123,11 +123,14 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
struct request_sock *req_unhash,
bool *own_req)
{
+ read_lock_bh(&((struct sock *)sk)->sk_callback_lock);
struct smc_sock *smc;
struct sock *child;
-
smc = smc_clcsock_user_data(sk);
+ if (!smc)
+ goto drop;
+
if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
sk->sk_max_ack_backlog)
goto drop;
@@ -148,9 +151,11 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
}
+ read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
return child;
drop:
+ read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
dst_release(dst);
tcp_listendrop(sk);
return NULL;
@@ -2613,7 +2618,7 @@ int smc_listen(struct socket *sock, int backlog)
int rc;
smc = smc_sk(sk);
- lock_sock(sk);
+ lock_sock(sock->sk);
rc = -EINVAL;
if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) ||
--
2.43.0
Powered by blists - more mailing lists