]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
net/smc: Fix slab-out-of-bounds issue in fallback
authorWen Gu <guwen@linux.alibaba.com>
Fri, 22 Apr 2022 07:56:19 +0000 (15:56 +0800)
committerJakub Kicinski <kuba@kernel.org>
Mon, 25 Apr 2022 18:03:48 +0000 (11:03 -0700)
commit0558226cebee256aa3f8ec0cc5a800a10bf120a6
treee30751d6e6b40913f4033d436e606fb2888a2bbe
parent97b9af7a70936e331170c79040cc9bf20071b566
net/smc: Fix slab-out-of-bounds issue in fallback

syzbot reported a slab-out-of-bounds/use-after-free issue,
which was caused by accessing an already freed smc sock in
fallback-specific callback functions of clcsock.

This patch fixes the issue by restoring fallback-specific
callback functions to original ones and resetting clcsock
sk_user_data to NULL before freeing smc sock.

Meanwhile, this patch introduces sk_callback_lock to make
the access and assignment to sk_user_data mutually exclusive.

Reported-by: syzbot+b425899ed22c6943e00b@syzkaller.appspotmail.com
Fixes: 341adeec9ada ("net/smc: Forward wakeup to smc socket waitqueue after fallback")
Link: https://lore.kernel.org/r/00000000000013ca8105d7ae3ada@google.com/
Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Acked-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/smc/af_smc.c
net/smc/smc_close.c