Commit 1cdac2b7 authored by Litao Jiao's avatar Litao Jiao
Browse files

net/smc: Ensure correct state of the socket in send path 

mainline inclusion
from mainline-v5.14-rc1
commit 17081633
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I78IFM
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=17081633e22d83be928a779fd7acd04b247dec90



--------------------------------

When smc_sendmsg() is called before the SMC socket initialization has
completed, smc_tx_sendmsg() will access un-initialized fields of the
SMC socket which results in a null-pointer dereference.
Fix this by checking the socket state first in smc_tx_sendmsg().

Fixes: e0e4b8fa ("net/smc: Add SMC statistics support")
Reported-by: default avatar <syzbot+5dda108b672b54141857@syzkaller.appspotmail.com>
Reviewed-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarGuvenc Gulce <guvenc@linux.ibm.com>
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 81e6fafb

net/smc/smc_tx.c

+3 −2
Original line number Diff line number Diff line
@@ -198,6 +198,9 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len) 
		goto out_err;

	}



	if (sk->sk_state == SMC_INIT)

		return -ENOTCONN;



	if (len > conn->sndbuf_desc->len)

		SMC_STAT_RMB_TX_SIZE_SMALL(!conn->lnk);
@@ -208,8 +211,6 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len) 
		SMC_STAT_INC(!conn->lnk, urg_data_cnt);



	while (msg_data_left(msg)) {

		if (sk->sk_state == SMC_INIT)

			return -ENOTCONN;

		if (smc->sk.sk_shutdown & SEND_SHUTDOWN ||

		    (smc->sk.sk_err == ECONNABORTED) ||

		    conn->killed)