github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-25 09:41:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/net/smc
History
Sidraya Jayagond 61cb282fe9 net/smc: fix UAF on lgr list traversal in smcr_port_err() 
smcr_port_err() traverses smc_lgr_list.list without holding
smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
to free an lgr while it is still being dereferenced.

Hold smc_lgr_list.lock across the traversal. Update
smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

Fixes: 541afa10c1 ("net/smc: add smcr_port_err() and smcr_link_down() processing")
Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Link: https://patch.msgid.link/20260922073149.474762-1-sidraya@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-24 10:19:50 -07:00
..
af_smc.c net/smc: hash socket only after full initialisation in smc_sk_init() 2026-08-18 12:07:19 +02:00
Kconfig net: smc: SMC_HS_CTRL_BPF should depend on BPF_JIT 2025-12-04 11:07:18 -08:00
Makefile net/smc: bpf: Introduce generic hook for handshake flow 2025-11-10 11:19:41 -08:00
smc_cdc.c net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket 2026-07-06 12:58:12 +02:00
smc_cdc.h net/smc: fix kernel panic caused by race of smc_sock 2021-12-28 12:42:45 +00:00
smc_clc.c net/smc: avoid early lgr access in smc_clc_wait_msg 2026-04-23 11:00:57 -07:00
smc_clc.h net/smc: check smcd_v2_ext_offset when receiving proposal msg 2024-12-15 12:34:59 +00:00
smc_close.c net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() 2026-03-16 19:31:28 -07:00
smc_close.h net/smc: remove close abort worker 2019-10-22 11:23:44 -07:00
smc_core.c net/smc: fix UAF on lgr list traversal in smcr_port_err() 2026-09-24 10:19:50 -07:00
smc_core.h net/smc: handle -ENOMEM from smc_wr_alloc_link_mem gracefully 2025-10-30 13:31:43 +01:00
smc_diag.c dibs: Local gid for dibs devices 2025-09-23 11:13:22 +02:00
smc_hs_bpf.c net/smc: bpf: Introduce generic hook for handshake flow 2025-11-10 11:19:41 -08:00
smc_hs_bpf.h net/smc: bpf: Introduce generic hook for handshake flow 2025-11-10 11:19:41 -08:00
smc_ib.c net/smc: fix UAF on lgr list traversal in smcr_port_err() 2026-09-24 10:19:50 -07:00
smc_ib.h net/smc: fix smc clc failed issue when netdevice not in init_net 2023-10-13 16:52:02 -07:00
smc_inet.c net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure 2026-08-27 10:54:38 +02:00
smc_inet.h net/smc: Introduce IPPROTO_SMC 2024-06-17 13:14:09 +01:00
smc_ism.c smc: Use flexible array for SMCD connections 2026-05-20 17:13:18 -07:00
smc_ism.h dibs: Move data path to dibs layer 2025-09-23 11:13:22 +02:00
smc_llc.c net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry 2026-08-22 13:25:52 -07:00
smc_llc.h net/smc: Introduce a specific sysctl for TEST_LINK time 2022-09-22 12:58:21 +02:00
smc_netlink.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
smc_netlink.h net/smc: add support for user defined EIDs 2021-09-14 12:49:10 +01:00
smc_netns.h net/smc: introduce list of pnetids for Ethernet devices 2020-09-28 15:19:03 -07:00
smc_pnet.c net/smc: Look up the pnetid ib device within the net namespace 2026-07-26 03:11:00 -04:00
smc_pnet.h net/smc: Use a mutex for locking "struct smc_pnettable" 2022-02-24 09:09:33 -08:00
smc_rx.c net/smc: fix use-after-free in smc_rx_pipe_buf_release() 2026-08-24 11:52:00 -07:00
smc_rx.h net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-01-13 18:59:00 -08:00
smc_stats.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
smc_stats.h net/smc: introduce statistics for ringbufs usage of net namespace 2024-08-20 11:38:23 +02:00
smc_sysctl.c net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
smc_sysctl.h net/smc: make wr buffer count configurable 2025-10-30 13:31:43 +01:00
smc_tracepoint.c net/smc: Introduce tracepoint for smcr link down 2021-11-01 13:39:14 +00:00
smc_tracepoint.h net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint 2026-05-12 18:44:36 -07:00
smc_tx.c net/smc: Decouple sf and attached send_buf in smc_loopback 2025-09-23 11:13:21 +02:00
smc_tx.h net/smc: do not dereference an unset send buffer on the SMC-D teardown path 2026-08-13 17:31:36 -07:00
smc_wr.c net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry 2026-08-22 13:25:52 -07:00
smc_wr.h net/smc: make wr buffer count configurable 2025-10-30 13:31:43 +01:00
smc.h net/smc: stop killed, freed and out_of_sync sharing a byte 2026-08-24 11:52:00 -07:00