netdev - Re: [PATCH net] net/smc: fix UAF on smcsk after smc_listen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: 
 <175565948574.3753798.15328877682080975423.git-patchwork-notify@kernel.org>
Date: Wed, 20 Aug 2025 03:11:25 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: D. Wythe <alibuda@...ux.alibaba.com>
Cc: Mahanta.Jambigi@....com, Sidraya.Jayagond@....com, wenjia@...ux.ibm.com,
 wintera@...ux.ibm.com, dust.li@...ux.alibaba.com, tonylu@...ux.alibaba.com,
 guwen@...ux.alibaba.com, kuba@...nel.org, davem@...emloft.net,
 netdev@...r.kernel.org, linux-s390@...r.kernel.org,
 linux-rdma@...r.kernel.org, pabeni@...hat.com, edumazet@...gle.com,
 jaka@...ux.ibm.com
Subject: Re: [PATCH net] net/smc: fix UAF on smcsk after smc_listen_out()

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@...nel.org>:

On Mon, 18 Aug 2025 13:46:18 +0800 you wrote:
> BPF CI testing report a UAF issue:
> 
>   [   16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003  0
>   [   16.447134] #PF: supervisor read access in kernel mod  e
>   [   16.447516] #PF: error_code(0x0000) - not-present pag  e
>   [   16.447878] PGD 0 P4D   0
>   [   16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT  I
>   [   16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G           OE      6.13.0-rc3-g89e8a75fda73-dirty #4  2
>   [   16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL  E
>   [   16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201  4
>   [   16.450201] Workqueue: smc_hs_wq smc_listen_wor  k
>   [   16.450531] RIP: 0010:smc_listen_work+0xc02/0x159  0
>   [   16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024  6
>   [   16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030  0
>   [   16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000  0
>   [   16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000  5
>   [   16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640  0
>   [   16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092  0
>   [   16.454996] FS:  0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000  0
>   [   16.455557] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003  3
>   [   16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef  0
>   [   16.456459] PKRU: 5555555  4
>   [   16.456654] Call Trace  :
>   [   16.456832]  <TASK  >
>   [   16.456989]  ? __die+0x23/0x7  0
>   [   16.457215]  ? page_fault_oops+0x180/0x4c  0
>   [   16.457508]  ? __lock_acquire+0x3e6/0x249  0
>   [   16.457801]  ? exc_page_fault+0x68/0x20  0
>   [   16.458080]  ? asm_exc_page_fault+0x26/0x3  0
>   [   16.458389]  ? smc_listen_work+0xc02/0x159  0
>   [   16.458689]  ? smc_listen_work+0xc02/0x159  0
>   [   16.458987]  ? lock_is_held_type+0x8f/0x10  0
>   [   16.459284]  process_one_work+0x1ea/0x6d  0
>   [   16.459570]  worker_thread+0x1c3/0x38  0
>   [   16.459839]  ? __pfx_worker_thread+0x10/0x1  0
>   [   16.460144]  kthread+0xe0/0x11  0
>   [   16.460372]  ? __pfx_kthread+0x10/0x1  0
>   [   16.460640]  ret_from_fork+0x31/0x5  0
>   [   16.460896]  ? __pfx_kthread+0x10/0x1  0
>   [   16.461166]  ret_from_fork_asm+0x1a/0x3  0
>   [   16.461453]  </TASK  >
>   [   16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)  ]
>   [   16.462134] CR2: 000000000000003  0
>   [   16.462380] ---[ end trace 0000000000000000 ]---
>   [   16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590
> 
> [...]

Here is the summary with links:
  - [net] net/smc: fix UAF on smcsk after smc_listen_out()
    https://git.kernel.org/netdev/net/c/d9cef55ed491

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html