From: Manas <manas18244@xxxxxxxxxxx> The last parameter in __smc_diag_dump (struct nlattr *bc) is unused. There is only one instance of this function being called and its passed with a NULL value in place of bc. Signed-off-by: Manas <manas18244@xxxxxxxxxxx> --- The last parameter in __smc_diag_dump (struct nlattr *bc) is unused. There is only one instance of this function being called and its passed with a NULL value in place of bc. Though, the compiler (gcc) optimizes it. Looking at the object dump of vmlinux (via `objdump -D vmlinux`), a new function clone (__smc_diag_dump.constprop.0) is added which removes this parameter from calling convention altogether. ffffffff8a701770 <__smc_diag_dump.constprop.0>: ffffffff8a701770: 41 57 push %r15 ffffffff8a701772: 41 56 push %r14 ffffffff8a701774: 41 55 push %r13 ffffffff8a701776: 41 54 push %r12 There are 5 parameters in original function, but in the cloned function only 4. I believe this patch also fixes this oops bug[1], which arises in the same function __smc_diag_dump. But I couldn't verify it further. Can someone please test this? [1] https://syzkaller.appspot.com/bug?extid=271fed3ed6f24600c364 --- net/smc/smc_diag.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c index 6fdb2d96777ad704c394709ec845f9ddef5e599a..8f7bd40f475945171a0afa5a2cce12d9aa2b1eb4 100644 --- a/net/smc/smc_diag.c +++ b/net/smc/smc_diag.c @@ -71,8 +71,7 @@ static int smc_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb, static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, struct netlink_callback *cb, - const struct smc_diag_req *req, - struct nlattr *bc) + const struct smc_diag_req *req) { struct smc_sock *smc = smc_sk(sk); struct smc_diag_fallback fallback; @@ -199,7 +198,6 @@ static int smc_diag_dump_proto(struct proto *prot, struct sk_buff *skb, struct smc_diag_dump_ctx *cb_ctx = smc_dump_context(cb); struct net *net = sock_net(skb->sk); int snum = cb_ctx->pos[p_type]; - struct nlattr *bc = NULL; struct hlist_head *head; int rc = 0, num = 0; struct sock *sk; @@ -214,7 +212,7 @@ static int smc_diag_dump_proto(struct proto *prot, struct sk_buff *skb, continue; if (num < snum) goto next; - rc = __smc_diag_dump(sk, skb, cb, nlmsg_data(cb->nlh), bc); + rc = __smc_diag_dump(sk, skb, cb, nlmsg_data(cb->nlh)); if (rc < 0) goto out; next: --- base-commit: 59b723cd2adbac2a34fc8e12c74ae26ae45bf230 change-id: 20241109-fix-oops-__smc_diag_dump-06ab3e9d39f4 Best regards, -- Manas <manas18244@xxxxxxxxxxx>
