Commit 7bf563ba authored by Xiang Mei's avatar Xiang Mei Committed by Jakub Kicinski
Browse files

net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint



The smc_msg_event tracepoint class, shared by smc_tx_sendmsg and
smc_rx_recvmsg, unconditionally dereferences smc->conn.lnk:

	__string(name, smc->conn.lnk->ibname)

conn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on
these paths already handles this (e.g. !conn->lnk in
SMC_STAT_RMB_TX_SIZE_SMALL()). With the tracepoint enabled, the first
sendmsg()/recvmsg() on an SMC-D socket crashes:

  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [...]
  RIP: 0010:strlen+0x1e/0xa0
  Call Trace:
   trace_event_raw_event_smc_msg_event (net/smc/smc_tracepoint.h:44)
   smc_rx_recvmsg (net/smc/smc_rx.c:515)
   smc_recvmsg (net/smc/af_smc.c:2859)
   __sys_recvfrom (net/socket.c:2315)
   __x64_sys_recvfrom (net/socket.c:2326)
   do_syscall_64

The faulting address 0x3e0 is offsetof(struct smc_link, ibname),
confirming the NULL ->lnk deref. Enabling the tracepoint requires
root, but the trigger itself is unprivileged: socket(AF_SMC, ...) has
no capability check, and SMC-D negotiation needs no admin step on
s390 or on x86 with the loopback ISM device loaded.

Log an empty device name for SMC-D instead of dereferencing NULL.

Fixes: aff3083f ("net/smc: Introduce tracepoints for tx and rx msg")
Reported-by: default avatarWeiming Shi <bestswngs@gmail.com>
Signed-off-by: default avatarXiang Mei <xmei5@asu.edu>
Reviewed-by: default avatarDust Li <dust.li@linux.alibaba.com>
Reviewed-by: default avatarSidraya Jayagond <sidraya@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent a3fdd924
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -51,7 +51,7 @@ DECLARE_EVENT_CLASS(smc_msg_event,
				     __field(const void *, smc)
				     __field(u64, net_cookie)
				     __field(size_t, len)
				     __string(name, smc->conn.lnk->ibname)
				     __string(name, smc->conn.lnk ? smc->conn.lnk->ibname : "")
		    ),

		    TP_fast_assign(