Jeongjun Park 98d4435efc net/smc: prevent NULL pointer dereference in txopt_get ... Since smc_inet6_prot does not initialize ipv6_pinfo_offset, inet6_create() copies an incorrect address value, sk + 0 (offset), to inet_sk(sk)->pinet6. In addition, since inet_sk(sk)->pinet6 and smc_sk(sk)->clcsock practically point to the same address, when smc_create_clcsk() stores the newly created clcsock in smc_sk(sk)->clcsock, inet_sk(sk)->pinet6 is corrupted into clcsock. This causes NULL pointer dereference and various other memory corruptions. To solve this problem, you need to initialize ipv6_pinfo_offset, add a smc6_sock structure, and then add ipv6_pinfo as the second member of the smc_sock structure. Reported-by: syzkaller <syzkaller@googlegroups.com> Fixes: d25a92ccae ("net/smc: Introduce IPPROTO_SMC") Signed-off-by: Jeongjun Park <aha310510@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2024-08-30 13:26:12 +01:00
..
af_smc.c	net/smc: prevent UAF in inet_create()	2024-07-30 11:12:25 +02:00
Kconfig	net/smc: introduce loopback-ism for SMC intra-OS shortcut	2024-04-30 13:24:48 +02:00
Makefile	net/smc: Introduce IPPROTO_SMC	2024-06-17 13:14:09 +01:00
smc_cdc.c	net/smc: adapt cursor update when sndbuf and peer DMB are merged	2024-04-30 13:24:48 +02:00
smc_cdc.h	net/smc: fix kernel panic caused by race of smc_sock	2021-12-28 12:42:45 +00:00
smc_clc.c	net/smc: Avoid -Wflex-array-member-not-at-end warnings	2024-04-03 11:01:30 +01:00
smc_clc.h	net/smc: Avoid -Wflex-array-member-not-at-end warnings	2024-04-03 11:01:30 +01:00
smc_close.c	net/smc: put sk reference if close work was canceled	2023-11-06 10:01:07 +00:00
smc_close.h	net/smc: remove close abort worker	2019-10-22 11:23:44 -07:00
smc_core.c	net/smc: change SMCR_RMBE_SIZES from 5 to 15	2024-06-03 12:12:42 +01:00
smc_core.h	net/smc: {at|de}tach sndbuf to peer DMB if supported	2024-04-30 13:24:48 +02:00
smc_diag.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-01-25 14:20:08 -08:00
smc_ib.c	net/smc: fix neighbour and rtable leak in smc_ib_find_route()	2024-05-09 10:03:43 +02:00
smc_ib.h	net/smc: fix smc clc failed issue when netdevice not in init_net	2023-10-13 16:52:02 -07:00
smc_inet.c	net/smc: prevent NULL pointer dereference in txopt_get	2024-08-30 13:26:12 +01:00
smc_inet.h	net/smc: Introduce IPPROTO_SMC	2024-06-17 13:14:09 +01:00
smc_ism.c	net/smc: add operations to merge sndbuf with peer DMB	2024-04-30 13:24:48 +02:00
smc_ism.h	net/smc: add operations to merge sndbuf with peer DMB	2024-04-30 13:24:48 +02:00
smc_llc.c	net/smc: support max links per lgr negotiation in clc handshake	2023-08-19 12:46:53 +01:00
smc_llc.h	net/smc: Introduce a specific sysctl for TEST_LINK time	2022-09-22 12:58:21 +02:00
smc_loopback.c	net/smc: implement DMB-merged operations of loopback-ism	2024-04-30 13:24:49 +02:00
smc_loopback.h	net/smc: implement DMB-merged operations of loopback-ism	2024-04-30 13:24:49 +02:00
smc_netlink.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
smc_netlink.h	net/smc: add support for user defined EIDs	2021-09-14 12:49:10 +01:00
smc_netns.h	net/smc: introduce list of pnetids for Ethernet devices	2020-09-28 15:19:03 -07:00
smc_pnet.c	net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()	2024-03-05 15:49:35 +01:00
smc_pnet.h	net/smc: Use a mutex for locking "struct smc_pnettable"	2022-02-24 09:09:33 -08:00
smc_rx.c	net: add sk_wake_async_rcu() helper	2024-03-29 15:03:11 -07:00
smc_rx.h
smc_stats.c	smc: Drop smc_sendpage() in favour of smc_sendmsg() + MSG_SPLICE_PAGES	2023-06-24 15:50:12 -07:00
smc_stats.h	net/smc: add the max value of fallback reason count	2024-08-07 19:36:23 -07:00
smc_sysctl.c	net: Remove ctl_table sentinel elements from several networking subsystems	2024-05-03 13:29:42 +01:00
smc_sysctl.h	net/smc: add sysctl for max conns per lgr for SMC-R v2.1	2023-11-24 12:13:14 +00:00
smc_tracepoint.c	net/smc: Introduce tracepoint for smcr link down	2021-11-01 13:39:14 +00:00
smc_tracepoint.h	tracing/treewide: Remove second parameter of __assign_str()	2024-05-22 20:14:47 -04:00
smc_tx.c	net/smc: remove unneeded atomic operations in smc_tx_sndbuf_nonempty	2023-11-24 15:00:47 +00:00
smc_tx.h	smc: Drop smc_sendpage() in favour of smc_sendmsg() + MSG_SPLICE_PAGES	2023-06-24 15:50:12 -07:00
smc_wr.c	net/smc: Use percpu ref for wr tx reference	2023-03-17 08:59:01 +00:00
smc_wr.h	net/smc: Use percpu ref for wr tx reference	2023-03-17 08:59:01 +00:00
smc.h	net/smc: prevent NULL pointer dereference in txopt_get	2024-08-30 13:26:12 +01:00