From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: Re: [Patch net] smc: move unhash as early as possible in smc_release() Date: Mon, 7 Jan 2019 11:25:12 -0800 Message-ID: References: <20190106074526.4882-1-xiyou.wangcong@gmail.com> <20190107.071250.1939806747054672326.davem@davemloft.net> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Linux Kernel Network Developers , mhjungk@gmail.com, syzbot , Ursula Braun To: David Miller Return-path: Received: from mail-pl1-f177.google.com ([209.85.214.177]:41945 "EHLO mail-pl1-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728187AbfAGTZY (ORCPT ); Mon, 7 Jan 2019 14:25:24 -0500 Received: by mail-pl1-f177.google.com with SMTP id u6so597878plm.8 for ; Mon, 07 Jan 2019 11:25:23 -0800 (PST) In-Reply-To: <20190107.071250.1939806747054672326.davem@davemloft.net> Sender: netdev-owner@vger.kernel.org List-ID: On Mon, Jan 7, 2019 at 7:12 AM David Miller wrote: > > From: Cong Wang > Date: Sat, 5 Jan 2019 23:45:26 -0800 > > > In smc_release() we release smc->clcsock before unhash the smc > > sock, but a parallel smc_diag_dump() may be still reading > > smc->clcsock, therefore this could cause a use-after-free as > > reported by syzbot. > > > > Reported-and-tested-by: syzbot+fbd1e5476e4c94c7b34e@syzkaller.appspotmail.com > > Fixes: 51f1de79ad8e ("net/smc: replace sock_put worker by socket refcounting") > > Cc: Ursula Braun > > Signed-off-by: Cong Wang > > We have two patches messing around in here, seeming to deal with release > visibility and ordering problems in two different ways. > > https://patchwork.ozlabs.org/patch/1020608/ > https://patchwork.ozlabs.org/patch/1021044/ > > Reported-by: syzbot+0bf2e01269f1274b4b03@syzkaller.appspotmail.com > Reported-by: syzbot+e3132895630f957306bc@syzkaller.appspotmail.com Isn't Myungho's patch already merged as commit 78abe3d0dfad? :) So I believe the syzbot reported this bug on top of that commit. Thanks.