On Tue, Mar 04, 2025 at 02:31:37AM -0500, ffhgfv wrote: > Hello, I found a bug titled "KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock" with modified syzkaller in the lasted upstream related to bcachefs file system. > If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao <xnxc22xnxc22@xxxxxx>, xingwei lee <xrivendell7@xxxxxxxxx>, Zhizhuo Tang <strforexctzzchange@xxxxxxxxxxx> > > ------------[ cut here ]------------ > TITLE: KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock > ================================================================== > BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] > BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] > BUG: KASAN: null-ptr-deref in smc_tcp_syn_recv_sock+0xa7/0x4c0 net/smc/af_smc.c:131 > Read of size 4 at addr 0000000000000a04 by task syz.7.21/12319 > > CPU: 1 UID: 0 PID: 12319 Comm: syz.7.21 Not tainted 6.14.0-rc5-dirty #2 > diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c > --- a/net/smc/af_smc.c > +++ b/net/smc/af_smc.c > @@ -128,6 +128,8 @@ > struct sock *child; > > smc = smc_clcsock_user_data(sk); > + if (!smc) > + goto drop; // Ensure that the smc pointer is valid before accessing its members Hi ffhgfv, Thanks for your report and solution. The bigger issue here is that smc_clcsock_user_data currently requires lock protection, which means we need to acquire the sk_callback_lock here. But the sk in this context is const, which violates the expected interface. In fact, we have been planning to replace sk_callback_lock with RCU, which should provide a better solution to this issue. However, there is still a significant backlog of tasks related to SMC, and we haven't had the bandwidth to address this yet. Anyway, we sincerely appreciate your report, and we will fix this issue in the future. Best wishes, D. Wythe > > if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) > > sk->sk_max_ack_backlog) > > ========================================================================= > I hope it helps. > Best regards > Jianzhou Zhao > xingwei lee > Zhizhuo Tang</strforexctzzchange@xxxxxxxxxxx></xrivendell7@xxxxxxxxx></xnxc22xnxc22@xxxxxx>
