From: Wen Gu guwen@linux.alibaba.com
mainline inclusion from mainline-v5.17-rc5 commit 1de9770d121ee9294794cca0e0be8fbfa0134ee8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA72JN CVE: CVE-2022-48721
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
The callback functions of clcsock will be saved and replaced during the fallback. But if the fallback happens more than once, then the copies of these callback functions will be overwritten incorrectly, resulting in a loop call issue:
clcsk->sk_error_report |- smc_fback_error_report() <------------------------------| |- smc_fback_forward_wakeup() | (loop) |- clcsock_callback() (incorrectly overwritten) | |- smc->clcsk_error_report() ------------------|
So this patch fixes the issue by saving these function pointers only once in the fallback and avoiding overwriting.
Reported-by: syzbot+4de3c0e8a263e1e499bc@syzkaller.appspotmail.com Fixes: 341adeec9ada ("net/smc: Forward wakeup to smc socket waitqueue after fallback") Link: https://lore.kernel.org/r/0000000000006d045e05d78776f6@google.com Signed-off-by: Wen Gu guwen@linux.alibaba.com Signed-off-by: David S. Miller davem@davemloft.net
Conflicts: net/smc/af_smc.c [The conflict occurs because the commit c0bf3d8a943b("net/smc: Transitional solution for clcsock race issue") and e0e4b8fa5338("net/smc: Add SMC statistics support") are not merged] Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com --- net/smc/af_smc.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 19551241c9d3..e630d676d963 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -628,6 +628,9 @@ static void smc_switch_to_fallback(struct smc_sock *smc)
clcsk = smc->clcsock->sk;
+ if (smc->use_fallback) + return; + smc->use_fallback = true; if (smc->sk.sk_socket && smc->sk.sk_socket->file) { smc->clcsock->file = smc->sk.sk_socket->file;