[syzbot ci] Re: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
From: syzbot ci <hidden>
Date: 2026-03-10 23:15:26
Also in:
linux-rdma, linux-s390, lkml, syzbot
syzbot ci has tested the following series [v3] net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() https://lore.kernel.org/all/20260310120053.136594-1-jiayuan.chen@linux.dev (local) * [PATCH net v3] net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() and found the following issues: * WARNING: suspicious RCU usage in smc_fback_error_report * WARNING: suspicious RCU usage in smc_fback_state_change * WARNING: suspicious RCU usage in smc_fback_write_space Full report is available here: https://ci.syzbot.org/series/b6883213-02f6-437e-bb3b-09fc59b0534c *** WARNING: suspicious RCU usage in smc_fback_error_report tree: net URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net.git base: 73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d arch: amd64 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 config: https://ci.syzbot.org/builds/0ecfc74c-85c7-4a7b-8b09-d322ac9ea108/config C repro: https://ci.syzbot.org/findings/f8c698ca-41b9-4ced-953c-f6c3ee405ebc/c_repro syz repro: https://ci.syzbot.org/findings/f8c698ca-41b9-4ced-953c-f6c3ee405ebc/syz_repro ============================= WARNING: suspicious RCU usage syzkaller #0 Not tainted ----------------------------- ./include/net/sock.h:682 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz.0.17/5970: #0: ffff88811a1d1d60 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff88811a1d1d60 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 net/ipv4/af_inet.c:749 #1: ffff88811a1d1f08 (k-clock-AF_INET6){++..}-{3:3}, at: smc_fback_error_report+0x2d/0x140 net/smc/af_smc.c:900 stack backtrace: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876 __rcu_dereference_sk_user_data_with_flags include/net/sock.h:682 [inline] smc_clcsock_user_data net/smc/smc.h:345 [inline] smc_fback_error_report+0x135/0x140 net/smc/af_smc.c:901 sk_error_report+0x48/0x2b0 net/core/sock.c:348 tcp_disconnect+0x132c/0x1fa0 net/ipv4/tcp.c:3543 __inet_stream_connect+0x32b/0xdd0 net/ipv4/af_inet.c:648 inet_stream_connect+0x66/0xa0 net/ipv4/af_inet.c:750 __sys_connect_file net/socket.c:2089 [inline] __sys_connect+0x312/0x450 net/socket.c:2108 __do_sys_connect net/socket.c:2114 [inline] __se_sys_connect net/socket.c:2111 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2111 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7effcfd9c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe9219fa18 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007effd0015fa0 RCX: 00007effcfd9c799 RDX: 000000000000000c RSI: 00002000000001c0 RDI: 0000000000000003 RBP: 00007effcfe32bd9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007effd0015fac R14: 00007effd0015fa0 R15: 00007effd0015fa0 </TASK> *** WARNING: suspicious RCU usage in smc_fback_state_change tree: net URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net.git base: 73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d arch: amd64 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 config: https://ci.syzbot.org/builds/0ecfc74c-85c7-4a7b-8b09-d322ac9ea108/config C repro: https://ci.syzbot.org/findings/fb044c1b-44f5-483a-bb87-1aad71a75a03/c_repro syz repro: https://ci.syzbot.org/findings/fb044c1b-44f5-483a-bb87-1aad71a75a03/syz_repro ============================= WARNING: suspicious RCU usage syzkaller #0 Not tainted ----------------------------- ./include/net/sock.h:682 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by syz.0.17/5945: #0: ffff8881be8b0ee0 (sk_lock-AF_SMC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff8881be8b0ee0 (sk_lock-AF_SMC){+.+.}-{0:0}, at: smc_sendmsg+0x52/0x4d0 net/smc/af_smc.c:2802 #1: ffff8881b9f04360 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #1: ffff8881b9f04360 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x21/0x50 net/ipv4/tcp.c:1464 #2: ffff8881b9f04508 (k-clock-AF_INET){++..}-{3:3}, at: smc_fback_state_change+0x2d/0x140 net/smc/af_smc.c:864 stack backtrace: CPU: 1 UID: 0 PID: 5945 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876 __rcu_dereference_sk_user_data_with_flags include/net/sock.h:682 [inline] smc_clcsock_user_data net/smc/smc.h:345 [inline] smc_fback_state_change+0x135/0x140 net/smc/af_smc.c:865 tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:7000 [inline] tcp_rcv_state_process+0x2b23/0x4810 net/ipv4/tcp_input.c:7215 tcp_v4_do_rcv+0x6bb/0x1430 net/ipv4/tcp_ipv4.c:1907 sk_backlog_rcv include/net/sock.h:1185 [inline] __release_sock+0x265/0x3a0 net/core/sock.c:3213 release_sock+0x5f/0x1f0 net/core/sock.c:3795 tcp_sendmsg+0x39/0x50 net/ipv4/tcp.c:1466 smc_sendmsg+0x250/0x4d0 net/smc/af_smc.c:2823 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0x972/0x9f0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9b66d9c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe630639c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9b67015fa0 RCX: 00007f9b66d9c799 RDX: 00000000200048cc RSI: 0000200000000240 RDI: 0000000000000003 RBP: 00007f9b66e32bd9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9b67015fac R14: 00007f9b67015fa0 R15: 00007f9b67015fa0 </TASK> *** WARNING: suspicious RCU usage in smc_fback_write_space tree: net URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net.git base: 73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d arch: amd64 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 config: https://ci.syzbot.org/builds/0ecfc74c-85c7-4a7b-8b09-d322ac9ea108/config C repro: https://ci.syzbot.org/findings/a3f8aa1e-ebea-41f3-b6e4-97d45bc19aaf/c_repro syz repro: https://ci.syzbot.org/findings/a3f8aa1e-ebea-41f3-b6e4-97d45bc19aaf/syz_repro ============================= WARNING: suspicious RCU usage syzkaller #0 Not tainted ----------------------------- ./include/net/sock.h:682 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz.0.17/5953: #0: ffff8881b9ed1c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff8881b9ed1c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: sockopt_lock_sock net/core/sock.c:1152 [inline] #0: ffff8881b9ed1c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: sk_setsockopt+0xe62/0x2e80 net/core/sock.c:1310 #1: ffff8881b9ed1e08 (k-clock-AF_INET){++..}-{3:3}, at: smc_fback_write_space+0x2d/0x140 net/smc/af_smc.c:888 stack backtrace: CPU: 1 UID: 0 PID: 5953 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876 __rcu_dereference_sk_user_data_with_flags include/net/sock.h:682 [inline] smc_clcsock_user_data net/smc/smc.h:345 [inline] smc_fback_write_space+0x135/0x140 net/smc/af_smc.c:889 sk_setsockopt+0x221f/0x2e80 net/core/sock.c:1351 do_sock_setsockopt+0x11b/0x1b0 net/socket.c:2318 __sys_setsockopt net/socket.c:2347 [inline] __do_sys_setsockopt net/socket.c:2353 [inline] __se_sys_setsockopt net/socket.c:2350 [inline] __x64_sys_setsockopt+0x13d/0x1b0 net/socket.c:2350 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0c5f39c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd35759278 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f0c5f615fa0 RCX: 00007f0c5f39c799 RDX: 0000000000000020 RSI: 0000000000000001 RDI: 0000000000000003 RBP: 00007f0c5f432bd9 R08: 0000000000000004 R09: 0000000000000000 R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0c5f615fac R14: 00007f0c5f615fa0 R15: 00007f0c5f615fa0 </TASK> *** If these findings have caused you to resend the series or submit a separate fix, please add the following tag to your commit message: Tested-by: syzbot@syzkaller.appspotmail.com --- This report is generated by a bot. It may contain errors. syzbot ci engineers can be reached at syzkaller@googlegroups.com.