smc_cdc_rx_handler() drops the link group's connection lock after looking
up a connection. Concurrent close(2) can then set conn->freed and release a
registration-failed receive buffer before the receive handler obtains the
socket lock. The handler subsequently dereferences the released descriptor.
KASAN reports:
BUG: KASAN: slab-use-after-free in smc_cdc_msg_recv (net/smc/smc_cdc.c:376 net/smc/smc_cdc.c:431)
Read of size 4 at addr ffff8881064a4720 by task kworker/u48:2/233
Workqueue: rxe_wq do_work
Call Trace:
smc_cdc_msg_recv (net/smc/smc_cdc.c:376 net/smc/smc_cdc.c:431)
smc_cdc_rx_handler (net/smc/smc_cdc.c:503)
smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445 net/smc/smc_wr.c:459 net/smc/smc_wr.c:498)
tasklet_action_common (kernel/softirq.c:961)
handle_softirqs (kernel/softirq.c:645)
do_softirq (kernel/softirq.c:546 (discriminator 19) kernel/softirq.c:533 (discriminator 19))
Freed by task 209:
__kasan_slab_free (mm/kasan/common.c:285)
kfree (./include/linux/kasan.h:235 mm/slub.c:2748
mm/slub.c:6508 mm/slub.c:6801)
smc_conn_free (net/smc/smc_core.c:1244 net/smc/smc_core.c:1283)
__smc_release (net/smc/af_smc.c:322)
smc_release (net/smc/af_smc.c:361)
__sock_release (net/socket.c:735)
sock_close (net/socket.c:1526 (discriminator 1))
__fput (fs/file_table.c:512)
fput_close_sync (fs/file_table.c:617)
__do_sys_close (fs/open.c:1560)
The buggy address is located 32 bytes inside of
freed 128-byte region [ffff8881064a4700, ffff8881064a4780)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Both smc_conn_free() and CDC message processing run under the socket lock.
Check conn->freed after acquiring that lock. Discard messages which passed
the lookup before teardown. This keeps the existing lock order and prevents
access to receive buffers released by smc_conn_free().
Fixes: a6920d1d130c ("net/smc: handle unregistered buffers")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei
Assisted-by: LLM
Signed-off-by: Weiming Shi
---
net/smc/smc_cdc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 32d6d03df321..499a2473b79b 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -428,7 +428,8 @@ static void smc_cdc_msg_recv(struct smc_sock *smc, struct smc_cdc_msg *cdc)
{
sock_hold(&smc->sk);
bh_lock_sock(&smc->sk);
- smc_cdc_msg_recv_action(smc, cdc);
+ if (!smc->conn.freed)
+ smc_cdc_msg_recv_action(smc, cdc);
bh_unlock_sock(&smc->sk);
sock_put(&smc->sk); /* no free sk in softirq-context */
}
--
2.56.0