netdev - Re: [PATCH v1 net] smc: Fix various oops due to inet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250714020432.GA90524@j66a10360.sqa.eu95>
Date: Mon, 14 Jul 2025 10:04:32 +0800
From: "D. Wythe" <alibuda@...ux.alibaba.com    >
To: Kuniyuki Iwashima <kuniyu@...gle.com>
Cc: "D. Wythe" <alibuda@...ux.alibaba.com>,
	Dust Li <dust.li@...ux.alibaba.com>,
	Sidraya Jayagond <sidraya@...ux.ibm.com>,
	Wenjia Zhang <wenjia@...ux.ibm.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Mahanta Jambigi <mjambigi@...ux.ibm.com>,
	Tony Lu <tonylu@...ux.alibaba.com>,
	Wen Gu <guwen@...ux.alibaba.com>, Simon Horman <horms@...nel.org>,
	Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org,
	linux-rdma@...r.kernel.org, linux-s390@...r.kernel.org,
	syzbot+40bf00346c3fe40f90f2@...kaller.appspotmail.com,
	syzbot+f22031fad6cbe52c70e7@...kaller.appspotmail.com,
	syzbot+271fed3ed6f24600c364@...kaller.appspotmail.com
Subject: Re: [PATCH v1 net] smc: Fix various oops due to inet_sock type
 confusion.

On Fri, Jul 11, 2025 at 06:07:52AM +0000, Kuniyuki Iwashima wrote:
> syzbot reported weird splats [0][1] in cipso_v4_sock_setattr() while
> freeing inet_sk(sk)->inet_opt.
> 
> The address was freed multiple times even though it was read-only memory.
> 
> cipso_v4_sock_setattr() did nothing wrong, and the root cause was type
> confusion.
> 
> The cited commit made it possible to create smc_sock as an INET socket.
> 
> The issue is that struct smc_sock does not have struct inet_sock as the
> first member but hijacks AF_INET and AF_INET6 sk_family, which confuses
> various places.
> 
> In this case, inet_sock.inet_opt was actually smc_sock.clcsk_data_ready(),
> which is an address of a function in the text segment.
> 
>   $ pahole -C inet_sock vmlinux
>   struct inet_sock {
>   ...
>           struct ip_options_rcu *    inet_opt;             /*   784     8 */
> 
>   $ pahole -C smc_sock vmlinux
>   struct smc_sock {
>   ...
>           void                       (*clcsk_data_ready)(struct sock *); /*   784     8 */
> 
> 
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index 3760131f14845..1882bab8e00e7 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -30,6 +30,10 @@
>  #include <linux/splice.h>
>  
>  #include <net/sock.h>
> +#include <net/inet_common.h>
> +#if IS_ENABLED(CONFIG_IPV6)
> +#include <net/ipv6.h>
> +#endif
>  #include <net/tcp.h>
>  #include <net/smc.h>
>  #include <asm/ioctls.h>
> @@ -360,6 +364,16 @@ static void smc_destruct(struct sock *sk)
>  		return;
>  	if (!sock_flag(sk, SOCK_DEAD))
>  		return;
> +	switch (sk->sk_family) {
> +	case AF_INET:
> +		inet_sock_destruct(sk);
> +		break;
> +#if IS_ENABLED(CONFIG_IPV6)
> +	case AF_INET6:
> +		inet6_sock_destruct(sk);
> +		break;
> +#endif
> +	}
>  }
>  
>  static struct lock_class_key smc_key;
> diff --git a/net/smc/smc.h b/net/smc/smc.h
> index 78ae10d06ed2e..2c90849637398 100644
> --- a/net/smc/smc.h
> +++ b/net/smc/smc.h
> @@ -283,10 +283,10 @@ struct smc_connection {
>  };
>  
>  struct smc_sock {				/* smc sock container */
> -	struct sock		sk;
> -#if IS_ENABLED(CONFIG_IPV6)
> -	struct ipv6_pinfo	*pinet6;
> -#endif
> +	union {
> +		struct sock		sk;
> +		struct inet_sock	icsk_inet;
> +	};
>  	struct socket		*clcsock;	/* internal tcp socket */
>  	void			(*clcsk_state_change)(struct sock *sk);
>  						/* original stat_change fct. */
> -- 

LGTM. This is what we should have resolved a long time ago. Thank
you for your report and repair!

Reviewed-by: D. Wythe <alibuda@...ux.alibaba.com>

> 2.50.0.727.gbf7dc18ff4-goog