linux-kernel - Re: [syzbot] [smc?] general protection fault in smc_diag_dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <03a57f0d-2b09-47d4-b1ac-f86dc128356b@linux.ibm.com>
Date: Wed, 17 Dec 2025 10:39:10 +0100
From: Alexandra Winter <wintera@...ux.ibm.com>
To: syzbot <syzbot+f69bfae0a4eb29976e44@...kaller.appspotmail.com>,
        agordeev@...ux.ibm.com, aha310510@...il.com, alibuda@...ux.alibaba.com,
        davem@...emloft.net, dust.li@...ux.alibaba.com, edumazet@...gle.com,
        gbayer@...ux.ibm.com, guwen@...ux.alibaba.com, horms@...nel.org,
        jaka@...ux.ibm.com, julianr@...ux.ibm.com, kuba@...nel.org,
        linux-kernel@...r.kernel.org, linux-rdma@...r.kernel.org,
        linux-s390@...r.kernel.org, lizhi.xu@...driver.com,
        netdev@...r.kernel.org, pabeni@...hat.com, sidraya@...ux.ibm.com,
        syzkaller-bugs@...glegroups.com, tonylu@...ux.alibaba.com,
        wenjia@...ux.ibm.com
Subject: Re: [syzbot] [smc?] general protection fault in smc_diag_dump_proto



On 07.12.25 05:29, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
> 
> commit d324a2ca3f8efd57f5839aa2690554a5cbb3586f
> Author: Alexandra Winter <wintera@...ux.ibm.com>
> Date:   Thu Sep 18 11:04:50 2025 +0000
> 
>     dibs: Register smc as dibs_client
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16d64eb4580000
> start commit:   dbb9a7ef3478 net: fjes: use ethtool string helpers
> git tree:       net-next
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a9d1c42858837b59
> dashboard link: https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178f0d5f980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10906b40580000
> 
> If the result looks correct, please mark the issue as fixed by replying with:
> 
> #syz fix: dibs: Register smc as dibs_client
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection


Unfortunately, I don't think
d324a2ca3f8e ("dibs: Register smc as dibs_client")
has fixed this issue.

Iiuc https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44 shows an occurrence on
2025/10/17 13:18 	net-next 	7e0d4c111369
that code level already contains the bisected commit 7e0d4c111369.


Looking at net/smc/af_smc.c:smc_init()
I think the bisected patch has changed the timing of smc_ism_init() which may have led to the bisect result.

I think the issue may stem from the order of calls in smc_init().
Especially smc_nl_init(), proto_register(&smc_proto, 1), proto_register(&smc_proto6, 1), sock_register(&smc_sock_family_ops)
are all being called before:	
	INIT_HLIST_HEAD(&smc_v4_hashinfo.ht);
	INIT_HLIST_HEAD(&smc_v6_hashinfo.ht);

I think this can lead to the described "KASAN: null-ptr-deref", when calling smc_diag_handler() while the module is still being initialized.
I tried to reproduce such a race by calling smc_pnet and 'modprobe -r smc_diag smc'. But I did not hit a KASAN warning with that setting.
I'll send a patch nevertheless.