Commit 235f8104 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Jakub Kicinski
Browse files

smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). 



smc_clc_prfx_match() is called from smc_listen_work() and
not under RCU nor RTNL.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Note that the returned value of smc_clc_prfx_match() is not
used in the caller.

Fixes: a046d57d ("smc: CLC handshake (incl. preparation steps)")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-4-kuniyu@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 935d783e

net/smc/smc_clc.c

+13 −13
Original line number Diff line number Diff line
@@ -657,26 +657,26 @@ static int smc_clc_prfx_match6_rcu(struct net_device *dev, 
int smc_clc_prfx_match(struct socket *clcsock,

		       struct smc_clc_msg_proposal_prefix *prop)

{

	struct dst_entry *dst = sk_dst_get(clcsock->sk);

	struct net_device *dev;

	struct dst_entry *dst;

	int rc;



	if (!dst) {

		rc = -ENOTCONN;

		goto out;

	}

	if (!dst->dev) {

	rcu_read_lock();



	dst = __sk_dst_get(clcsock->sk);

	dev = dst ? dst_dev_rcu(dst) : NULL;

	if (!dev) {

		rc = -ENODEV;

		goto out_rel;

		goto out;

	}

	rcu_read_lock();



	if (!prop->ipv6_prefixes_cnt)

		rc = smc_clc_prfx_match4_rcu(dst->dev, prop);

		rc = smc_clc_prfx_match4_rcu(dev, prop);

	else

		rc = smc_clc_prfx_match6_rcu(dst->dev, prop);

	rcu_read_unlock();

out_rel:

	dst_release(dst);

		rc = smc_clc_prfx_match6_rcu(dev, prop);

out:

	rcu_read_unlock();



	return rc;

}