Commit 98d4435e authored by Jeongjun Park's avatar Jeongjun Park Committed by David S. Miller
Browse files

net/smc: prevent NULL pointer dereference in txopt_get 



Since smc_inet6_prot does not initialize ipv6_pinfo_offset, inet6_create()
copies an incorrect address value, sk + 0 (offset), to inet_sk(sk)->pinet6.

In addition, since inet_sk(sk)->pinet6 and smc_sk(sk)->clcsock practically
point to the same address, when smc_create_clcsk() stores the newly
created clcsock in smc_sk(sk)->clcsock, inet_sk(sk)->pinet6 is corrupted
into clcsock. This causes NULL pointer dereference and various other
memory corruptions.

To solve this problem, you need to initialize ipv6_pinfo_offset, add a
smc6_sock structure, and then add ipv6_pinfo as the second member of
the smc_sock structure.

Reported-by: default avatarsyzkaller <syzkaller@googlegroups.com>
Fixes: d25a92cc ("net/smc: Introduce IPPROTO_SMC")
Signed-off-by: default avatarJeongjun Park <aha310510@gmail.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1bb3c548

net/smc/smc.h

+3 −0
Original line number Diff line number Diff line
@@ -284,6 +284,9 @@ struct smc_connection { 


struct smc_sock {				/* smc sock container */

	struct sock		sk;

#if IS_ENABLED(CONFIG_IPV6)

	struct ipv6_pinfo	*pinet6;

#endif

	struct socket		*clcsock;	/* internal tcp socket */

	void			(*clcsk_state_change)(struct sock *sk);

						/* original stat_change fct. */

net/smc/smc_inet.c

+7 −1
Original line number Diff line number Diff line
@@ -60,6 +60,11 @@ static struct inet_protosw smc_inet_protosw = { 
};



#if IS_ENABLED(CONFIG_IPV6)

struct smc6_sock {

	struct smc_sock		smc;

	struct ipv6_pinfo	inet6;

};



static struct proto smc_inet6_prot = {

	.name		= "INET6_SMC",

	.owner		= THIS_MODULE,
@@ -67,9 +72,10 @@ static struct proto smc_inet6_prot = { 
	.hash		= smc_hash_sk,

	.unhash		= smc_unhash_sk,

	.release_cb	= smc_release_cb,

	.obj_size	= sizeof(struct smc_sock),

	.obj_size	= sizeof(struct smc6_sock),

	.h.smc_hash	= &smc_v6_hashinfo,

	.slab_flags	= SLAB_TYPESAFE_BY_RCU,

	.ipv6_pinfo_offset	= offsetof(struct smc6_sock, inet6),

};



static const struct proto_ops smc_inet6_stream_ops = {