On 2022/2/9 4:21 am, syzbot wrote:
The issue was bisected to:
commit 341adeec9adad0874f29a0a1af35638207352a39
Author: Wen Gu <guwen@xxxxxxxxxxxxxxxxx>
Date: Wed Jan 26 15:33:04 2022 +0000
net/smc: Forward wakeup to smc socket waitqueue after fallback
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11c2637c700000
final oops: https://syzkaller.appspot.com/x/report.txt?x=13c2637c700000
console output: https://syzkaller.appspot.com/x/log.txt?x=15c2637c700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4de3c0e8a263e1e499bc@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: 341adeec9ada ("net/smc: Forward wakeup to smc socket waitqueue after fallback")
Thanks for all the details provided by syzbot.
I reproduced this issue in my environment. It is caused by repeated calls to
smc_switch_to_fallback().
In 341adeec9ada ("net/smc: Forward wakeup to smc socket waitqueue after fallback"),
smc_switch_to_fallback() saves the original callback function of clcsock in
smc->clcsk_error_report and set clcsk->sk_error_report as smc_fback_error_report().
If smc_switch_to_fallback() is called repeatedly, the smc->clcsk_error_report will be
reset as clcsk->sk_error_report, which now is smc_fback_error_report().
And the call trace will be:
clcsk->sk_error_report
|- smc_fback_error_report() <----------------|
|- smc_fback_forward_wakeup() |
|- clcsock_callback() |
|- smc->clcsk_error_report() -|
Thus resulting in this issue.
I will send a patch to fix it.
