github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-21 12:20:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
fc9c7ca5fc
linux/drivers
History
Hidayath Khan a10ea94335 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister 
dibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()
look up the dmb_node under dmb_ht_lock, drop the lock and only then
operate on the node's refcount. Nothing keeps the node alive across
that window: __dibs_lo_unregister_dmb() removes the node from the hash
table under the write lock and immediately frees it.

A concurrent final put can therefore free the node between the lookup
and the refcount operation:

CPU0 (attach)                     CPU1 (owner unregisters)

read_lock_bh(&dmb_ht_lock)
find dmb_node (refcnt == 1)
read_unlock_bh(&dmb_ht_lock)
                                  refcount_dec_and_test() 1 -> 0
                                  write_lock_bh(&dmb_ht_lock)
                                  hash_del(&dmb_node->list)
                                  write_unlock_bh(&dmb_ht_lock)
                                  kfree(dmb_node)
refcount_inc_not_zero(&dmb_node->refcnt)  <-- use-after-free

The same window exists for the refcount_dec_and_test() calls in the
detach and unregister paths.

Close the race structurally by making hash table membership and the
refcount transitions atomic with respect to each other:

- Perform the final refcount_dec_and_test() and hash_del() in a single
  dmb_ht_lock write-side critical section, in both the unregister and
  the detach path. Freeing the node still happens after the lock is
  dropped, which is safe because a node whose refcount reached zero has
  left the hash table and can no longer be found.

- This establishes the invariant that any node found in the hash table
  holds at least one reference, and that the final reference can only
  be dropped under the write lock. dibs_lo_attach_dmb() can thus take
  its reference with a plain refcount_inc() while still holding the
  read lock; refcount_inc_not_zero() is no longer needed.

__dibs_lo_unregister_dmb() no longer touches the hash table and is
renamed to dibs_lo_free_dmb() accordingly.

Note: commit cc21191b58 ("dibs: Move data path to dibs layer") moved
the code to its current location; the race was introduced earlier by
commit c3a910f238 ("net/smc: implement DMB-merged operations of
loopback-ism").

Tested SMC-D via ISM and dibs loopback.

Cc: stable@vger.kernel.org
Fixes: c3a910f238 ("net/smc: implement DMB-merged operations of loopback-ism")
Reported-by: Rahul Chandelkar <rc@rexion.ai>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20260727093530.968834-1-hidayath@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-29 16:46:51 -07:00
..
accel accel/amdxdna: Fix use-after-free of mm_struct in job scheduler 2026-07-16 20:05:28 -07:00
accessibility
acpi ACPI support fixes for 7.2-rc2 2026-07-03 15:13:50 -10:00
amba
android rust_binder: clear freeze listener on node removal 2026-07-03 13:54:10 +02:00
ata ata fixes for 7.2-rc4 2026-07-17 17:58:57 -07:00
atm atm: remove unused ATM PHY operations 2026-06-16 08:53:53 -07:00
auxdisplay Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
base regmap: Fix for v7.2 2026-06-26 10:47:26 -07:00
bcma
block block-7.2-20260717 2026-07-19 09:29:42 -07:00
bluetooth Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() 2026-07-28 16:13:48 -04:00
bus Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cache Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cdrom
cdx Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
char tpm: Make the TPM character devices non-seekable 2026-07-12 12:52:34 -07:00
clk Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
clocksource A series of updates for the VDSO: 2026-06-15 13:57:13 +05:30
comedi
connector
counter Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cpufreq cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq 2026-07-09 20:31:57 +02:00
cpuidle cpuidle: Allow exit latency to exceed target residency 2026-06-23 14:00:29 +02:00
crypto Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cxl Merge branch 'for-7.2/cxl-type2-attach-region' into cxl-for-next 2026-06-12 13:47:53 -07:00
dax mm.git review status for mm-hotfixes-stable..mm-stable 2026-06-19 10:14:34 -07:00
dca
devfreq Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
dibs dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister 2026-07-29 16:46:51 -07:00
dio
dma Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
dma-buf udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() 2026-07-10 16:26:39 -07:00
dpll dpll: use pin owner's dpll ref for pin-level attribute reporting 2026-07-24 16:15:19 -07:00
edac Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
eisa
extcon Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
firewire Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
firmware SoC fixes for 7.2 2026-07-17 08:52:09 -07:00
fpga Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fwctl
gnss
gpib Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
gpio gpio: mvebu: free generic chips on unbind 2026-07-08 14:05:11 +02:00
gpu drm fixes for 7.2-rc4 2026-07-17 16:56:55 -07:00
greybus
hid Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
hsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hte Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hv hyperv-next for v7.2-rc1 2026-06-22 08:06:13 -07:00
hwmon hwmon: occ: validate poll response sensor blocks 2026-07-20 07:29:44 -07:00
hwspinlock
hwtracing Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
i2c i2c: mediatek: fix WRRD for SoCs without auto_restart option 2026-07-15 00:21:51 +02:00
i3c i3c: mipi-i3c-hci: Use named initializers for platform_device_id's .driver_data 2026-06-16 23:19:45 +02:00
idle x86/msr updates for v7.2: 2026-06-15 15:08:14 +05:30
iio Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
infiniband bnge/bng_re: fix ring ID widths 2026-07-23 10:24:12 -07:00
input Input updates for v7.2-rc2 2026-07-11 15:42:55 -07:00
interconnect Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
iommu Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ipack
irqchip Misc irqchip driver fixes: 2026-07-05 05:29:41 -10:00
leds Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
macintosh
mailbox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mcb
md dm thin metadata: fix superblock refcount leak on snapshot shadow failure 2026-07-11 15:18:51 +02:00
media Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memory Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memstick memstick: ms_block: reject a card that reports too many blocks 2026-07-06 17:09:30 +02:00
message
mfd Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
misc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mmc mmc: sdhci-esdhc-imx: fix resume error handling 2026-07-15 11:00:02 +02:00
most
mtd Among the most important fixes that we have here, there are: 2026-07-17 09:30:17 -07:00
mux Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
net net: sxgbe: check descriptor ring allocation failures 2026-07-29 09:33:10 +01:00
nfc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ntb NTB updates include an EPF bug fix to prevent an invalid unmap during 2026-06-28 07:46:12 -07:00
nubus
nvdimm Updates for the 7.2 release 2026-06-18 16:27:58 -07:00
nvme block-7.2-20260625 2026-06-25 09:56:47 -07:00
nvmem Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
of Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
opp
parisc
parport
pci Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pcmcia
peci
perf Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
phy Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pinctrl gpio fixes for v7.2-rc2 2026-07-03 05:38:12 -10:00
platform platform-drivers-x86 for v7.2-3 2026-07-22 10:36:10 -07:00
pmdomain pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check 2026-07-13 12:42:17 +02:00
pnp Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
power Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
powercap
pps Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ps3
ptp ptp: netc: explicitly clear TMR_OFF during initialization 2026-07-23 09:16:14 -07:00
pwm Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rapidio mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
ras - Fix a malformed Kconfig default for the AMD Address Translation Library 2026-06-16 05:31:01 +05:30
regulator regulator: ltc3676: Fix incorrect IRQSTAT bit offsets 2026-07-16 16:19:07 +01:00
remoteproc
resctrl arm64 updates for 7.2 2026-06-16 05:18:04 +05:30
reset Reset controller fixes for v7.2 2026-07-10 14:15:39 +02:00
rpmsg rpmsg update for v7.2 2026-06-20 23:31:15 -07:00
rtc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
s390 s390/qeth: Check CAP_NET_ADMIN for private ioctls 2026-07-27 18:05:19 -07:00
sbus
scsi scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path 2026-07-12 22:21:22 -04:00
sh
siox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
slimbus
soc soc/tegra: Fixes for v7.2 2026-07-10 14:42:00 +02:00
soundwire Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
spi spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled 2026-07-14 12:54:50 +01:00
spmi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ssb
staging staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() 2026-07-07 13:43:27 +02:00
target scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE 2026-07-12 22:21:22 -04:00
tc
tee soc: drivers for 7.2 2026-06-17 11:21:40 -07:00
thermal Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
thunderbolt USB/Thunderbolt driver changes for 7.2-rc1 2026-06-22 12:09:47 -07:00
tty TTY/Serial fixes for 7.2-rc3 2026-07-12 12:29:38 -07:00
ufs scsi: ufs: core: tracing: Do not dereference pointers in TP_printk() 2026-07-08 21:51:36 -04:00
uio Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
usb usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect 2026-07-23 08:26:15 -07:00
vdpa Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
vfio vfio/pci: Expose latched module parameter policy in debugfs 2026-06-29 14:26:31 -06:00
vhost vhost-net: fix TX stall when vhost owns virtio-net header 2026-07-21 13:25:34 +02:00
video Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
virt Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
virtio mm: page_reporting: allow driver to set batch capacity 2026-07-09 15:48:56 -07:00
w1 Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
watchdog watchdog fixes for v7.2-rc5 2026-07-22 11:15:49 -07:00
xen SCSI fixes on 20260718 2026-07-18 12:36:19 -07:00
zorro
Kconfig
Makefile