[syzbot] [rdma?] [s390?] [net?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot] [rdma?] [s390?] [net?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    850925a8133c Merge tag '9p-for-6.12-rc5' of https://github..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1227aa87980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=17c0d505695d6b0
dashboard link: https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15489230580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6d8177e17058/disk-850925a8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5d88252f39ff/vmlinux-850925a8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7a675a61b90d/bzImage-850925a8.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+827ae2bfb3a3529333e9@syzkaller.appspotmail.com

TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies.
TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies.
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in smc_tcp_syn_recv_sock+0xa7/0x4b0 net/smc/af_smc.c:131
Read of size 4 at addr 00000000000009d4 by task syz.4.10809/28966

CPU: 1 UID: 0 PID: 28966 Comm: syz.4.10809 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 smc_tcp_syn_recv_sock+0xa7/0x4b0 net/smc/af_smc.c:131
 tcp_get_cookie_sock+0xd5/0x790 net/ipv4/syncookies.c:204
 cookie_v4_check+0xcf8/0x1d40 net/ipv4/syncookies.c:485
 tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1864 [inline]
 tcp_v4_do_rcv+0x98e/0xa90 net/ipv4/tcp_ipv4.c:1923
 tcp_v4_rcv+0x3cd2/0x4390 net/ipv4/tcp_ipv4.c:2340
 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:449 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:5666
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5779
 process_backlog+0x443/0x15f0 net/core/dev.c:6111
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:6775
 napi_poll net/core/dev.c:6844 [inline]
 net_rx_action+0xa92/0x1010 net/core/dev.c:6966
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 do_softirq kernel/softirq.c:455 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:442
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]
 __dev_queue_xmit+0x887/0x4350 net/core/dev.c:4455
 dev_queue_xmit include/linux/netdevice.h:3094 [inline]
 neigh_hh_output include/net/neighbour.h:526 [inline]
 neigh_output include/net/neighbour.h:540 [inline]
 ip_finish_output2+0x16d7/0x2530 net/ipv4/ip_output.c:236
 __ip_finish_output net/ipv4/ip_output.c:314 [inline]
 __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:296
 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:324
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:434
 dst_output include/net/dst.h:450 [inline]
 ip_local_out+0x33e/0x4a0 net/ipv4/ip_output.c:130
 __ip_queue_xmit+0x747/0x1940 net/ipv4/ip_output.c:536
 __tcp_transmit_skb+0x2a4c/0x3dc0 net/ipv4/tcp_output.c:1466
 __tcp_send_ack.part.0+0x390/0x720 net/ipv4/tcp_output.c:4268
 __tcp_send_ack net/ipv4/tcp_output.c:4274 [inline]
 tcp_send_ack+0x82/0xa0 net/ipv4/tcp_output.c:4274
 tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:6576 [inline]
 tcp_rcv_state_process+0x4332/0x4f30 net/ipv4/tcp_input.c:6770
 tcp_v4_do_rcv+0x1ad/0xa90 net/ipv4/tcp_ipv4.c:1938
 sk_backlog_rcv include/net/sock.h:1115 [inline]
 __release_sock+0x31b/0x400 net/core/sock.c:3072
 release_sock+0x5a/0x220 net/core/sock.c:3626
 mptcp_connect+0xc14/0xee0 net/mptcp/protocol.c:3800
 __inet_stream_connect+0x3ca/0x1020 net/ipv4/af_inet.c:679
 inet_stream_connect+0x57/0xa0 net/ipv4/af_inet.c:750
 __sys_connect_file+0x150/0x190 net/socket.c:2071
 __sys_connect+0x147/0x180 net/socket.c:2088
 __do_sys_connect net/socket.c:2098 [inline]
 __se_sys_connect net/socket.c:2095 [inline]
 __x64_sys_connect+0x72/0xb0 net/socket.c:2095
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f68acb7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f68ada08038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f68acd35f80 RCX: 00007f68acb7e719
RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007f68acbf132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f68acd35f80 R15: 00007ffdea14cb48
 </TASK>
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc000000013a: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000009d0-0x00000000000009d7]
CPU: 1 UID: 0 PID: 28966 Comm: syz.4.10809 Tainted: G    B              6.12.0-rc4-syzkaller-00261-g850925a8133c #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:smc_tcp_syn_recv_sock+0xb8/0x4b0 net/smc/af_smc.c:131
Code: ad d4 09 00 00 be 04 00 00 00 44 8b bb 1c 04 00 00 4c 89 ef e8 69 94 2e f7 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 34
RSP: 0018:ffffc90000a18668 EFLAGS: 00010217
RAX: dffffc0000000000 RBX: ffff88805b9cb600 RCX: ffffffff814e856f
RDX: 000000000000013a RSI: ffffffff81ee031e RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 6e696c6261736944 R12: ffff88807df5bd00
R13: 00000000000009d4 R14: ffffc90000a186e8 R15: 0000000000000000
FS:  00007f68ada086c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f68ad9e7d58 CR3: 000000005e3fa000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 tcp_get_cookie_sock+0xd5/0x790 net/ipv4/syncookies.c:204
 cookie_v4_check+0xcf8/0x1d40 net/ipv4/syncookies.c:485
 tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1864 [inline]
 tcp_v4_do_rcv+0x98e/0xa90 net/ipv4/tcp_ipv4.c:1923
 tcp_v4_rcv+0x3cd2/0x4390 net/ipv4/tcp_ipv4.c:2340
 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:449 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:5666
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5779
 process_backlog+0x443/0x15f0 net/core/dev.c:6111
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:6775
 napi_poll net/core/dev.c:6844 [inline]
 net_rx_action+0xa92/0x1010 net/core/dev.c:6966
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 do_softirq kernel/softirq.c:455 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:442
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]
 __dev_queue_xmit+0x887/0x4350 net/core/dev.c:4455
 dev_queue_xmit include/linux/netdevice.h:3094 [inline]
 neigh_hh_output include/net/neighbour.h:526 [inline]
 neigh_output include/net/neighbour.h:540 [inline]
 ip_finish_output2+0x16d7/0x2530 net/ipv4/ip_output.c:236
 __ip_finish_output net/ipv4/ip_output.c:314 [inline]
 __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:296
 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:324
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:434
 dst_output include/net/dst.h:450 [inline]
 ip_local_out+0x33e/0x4a0 net/ipv4/ip_output.c:130
 __ip_queue_xmit+0x747/0x1940 net/ipv4/ip_output.c:536
 __tcp_transmit_skb+0x2a4c/0x3dc0 net/ipv4/tcp_output.c:1466
 __tcp_send_ack.part.0+0x390/0x720 net/ipv4/tcp_output.c:4268
 __tcp_send_ack net/ipv4/tcp_output.c:4274 [inline]
 tcp_send_ack+0x82/0xa0 net/ipv4/tcp_output.c:4274
 tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:6576 [inline]
 tcp_rcv_state_process+0x4332/0x4f30 net/ipv4/tcp_input.c:6770
 tcp_v4_do_rcv+0x1ad/0xa90 net/ipv4/tcp_ipv4.c:1938
 sk_backlog_rcv include/net/sock.h:1115 [inline]
 __release_sock+0x31b/0x400 net/core/sock.c:3072
 release_sock+0x5a/0x220 net/core/sock.c:3626
 mptcp_connect+0xc14/0xee0 net/mptcp/protocol.c:3800
 __inet_stream_connect+0x3ca/0x1020 net/ipv4/af_inet.c:679
 inet_stream_connect+0x57/0xa0 net/ipv4/af_inet.c:750
 __sys_connect_file+0x150/0x190 net/socket.c:2071
 __sys_connect+0x147/0x180 net/socket.c:2088
 __do_sys_connect net/socket.c:2098 [inline]
 __se_sys_connect net/socket.c:2095 [inline]
 __x64_sys_connect+0x72/0xb0 net/socket.c:2095
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f68acb7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f68ada08038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f68acd35f80 RCX: 00007f68acb7e719
RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007f68acbf132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f68acd35f80 R15: 00007ffdea14cb48
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:smc_tcp_syn_recv_sock+0xb8/0x4b0 net/smc/af_smc.c:131
Code: ad d4 09 00 00 be 04 00 00 00 44 8b bb 1c 04 00 00 4c 89 ef e8 69 94 2e f7 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 34
RSP: 0018:ffffc90000a18668 EFLAGS: 00010217
RAX: dffffc0000000000 RBX: ffff88805b9cb600 RCX: ffffffff814e856f
RDX: 000000000000013a RSI: ffffffff81ee031e RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 6e696c6261736944 R12: ffff88807df5bd00
R13: 00000000000009d4 R14: ffffc90000a186e8 R15: 0000000000000000
FS:  00007f68ada086c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f68ad9e7d58 CR3: 000000005e3fa000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	09 00                	or     %eax,(%rax)
   2:	00 be 04 00 00 00    	add    %bh,0x4(%rsi)
   8:	44 8b bb 1c 04 00 00 	mov    0x41c(%rbx),%r15d
   f:	4c 89 ef             	mov    %r13,%rdi
  12:	e8 69 94 2e f7       	call   0xf72e9480
  17:	4c 89 ea             	mov    %r13,%rdx
  1a:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  21:	fc ff df
  24:	48 c1 ea 03          	shr    $0x3,%rdx
* 28:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx <-- trapping instruction
  2c:	4c 89 e8             	mov    %r13,%rax
  2f:	83 e0 07             	and    $0x7,%eax
  32:	83 c0 03             	add    $0x3,%eax
  35:	38 d0                	cmp    %dl,%al
  37:	7c 08                	jl     0x41
  39:	84 d2                	test   %dl,%dl
  3b:	0f                   	.byte 0xf
  3c:	85                   	.byte 0x85
  3d:	34                   	.byte 0x34


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] Re: [syzbot] [rdma?] [s390?] [net?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [rdma?] [s390?] [net?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock
Author: richard120310@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 850925a8133c

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 3e6cb35baf25..41f8dcd734a6 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -127,6 +127,8 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
 	struct sock *child;
 
 	smc = smc_clcsock_user_data(sk);
+	if (!smc)
+		goto drop;
 
 	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
 				sk->sk_max_ack_backlog)

syztest

[Arnaud Lecomte]

#syz test

--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -123,11 +123,14 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
 					  struct request_sock *req_unhash,
 					  bool *own_req)
 {
+        read_lock_bh(&((struct sock *)sk)->sk_callback_lock);
 	struct smc_sock *smc;
 	struct sock *child;
-
 	smc = smc_clcsock_user_data(sk);
 
+	if (!smc)
+		goto drop;
+
 	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
 				sk->sk_max_ack_backlog)
 		goto drop;
@@ -148,9 +151,11 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
 		if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
 			inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
 	}
+	read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
 	return child;
 
 drop:
+	read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
 	dst_release(dst);
 	tcp_listendrop(sk);
 	return NULL;
@@ -2613,7 +2618,7 @@ int smc_listen(struct socket *sock, int backlog)
 	int rc;
 
 	smc = smc_sk(sk);
-	lock_sock(sk);
+	lock_sock(sock->sk);
 
 	rc = -EINVAL;
 	if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) ||
-- 
2.43.0

Re: [syzbot] [smc?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in inet_child_forget

======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc3-syzkaller-00329-gdfba48a70cb6-dirty #0 Not tainted
------------------------------------------------------
syz.3.22/6775 is trying to acquire lock:
ffff888031981170 (k-clock-AF_INET6){++.-}-{3:3}, at: sock_orphan include/net/sock.h:2075 [inline]
ffff888031981170 (k-clock-AF_INET6){++.-}-{3:3}, at: inet_child_forget+0x7e/0x2e0 net/ipv4/inet_connection_sock.c:1383

but task is already holding lock:
ffff888031980f58 (k-slock-AF_INET6){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff888031980f58 (k-slock-AF_INET6){+.-.}-{3:3}, at: inet_csk_listen_stop+0x203/0x1090 net/ipv4/inet_connection_sock.c:1495

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (k-slock-AF_INET6){+.-.}-{3:3}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       sk_clone_lock+0x334/0x1330 net/core/sock.c:2499
       inet_csk_clone_lock+0x2a/0x750 net/ipv4/inet_connection_sock.c:1232
       tcp_create_openreq_child+0x34/0x1980 net/ipv4/tcp_minisocks.c:526
       tcp_v4_syn_recv_sock+0x115/0x1250 net/ipv4/tcp_ipv4.c:1774
       tcp_v6_syn_recv_sock+0x1353/0x2480 net/ipv6/tcp_ipv6.c:1382
       smc_tcp_syn_recv_sock+0x24b/0x500 net/smc/af_smc.c:144
       tcp_check_req+0x69d/0x1f80 net/ipv4/tcp_minisocks.c:874
       tcp_v4_rcv+0x19b0/0x4650 net/ipv4/tcp_ipv4.c:2283
       ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
       ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
       NF_HOOK include/linux/netfilter.h:317 [inline]
       NF_HOOK include/linux/netfilter.h:311 [inline]
       ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
       dst_input include/net/dst.h:469 [inline]
       ip_rcv_finish net/ipv4/ip_input.c:447 [inline]
       NF_HOOK include/linux/netfilter.h:317 [inline]
       NF_HOOK include/linux/netfilter.h:311 [inline]
       ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:567
       __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5977
       __netif_receive_skb+0x1d/0x160 net/core/dev.c:6090
       process_backlog+0x442/0x15e0 net/core/dev.c:6442
       __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7414
       napi_poll net/core/dev.c:7478 [inline]
       net_rx_action+0xa9f/0xfe0 net/core/dev.c:7605
       handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
       do_softirq kernel/softirq.c:480 [inline]
       do_softirq+0xb2/0xf0 kernel/softirq.c:467
       __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:407
       local_bh_enable include/linux/bottom_half.h:33 [inline]
       rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
       __dev_queue_xmit+0x8ab/0x43e0 net/core/dev.c:4740
       dev_queue_xmit include/linux/netdevice.h:3355 [inline]
       neigh_hh_output include/net/neighbour.h:523 [inline]
       neigh_output include/net/neighbour.h:537 [inline]
       ip_finish_output2+0xc38/0x21a0 net/ipv4/ip_output.c:235
       __ip_finish_output net/ipv4/ip_output.c:313 [inline]
       __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:295
       ip_finish_output+0x35/0x380 net/ipv4/ip_output.c:323
       NF_HOOK_COND include/linux/netfilter.h:306 [inline]
       ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433
       dst_output include/net/dst.h:459 [inline]
       ip_local_out net/ipv4/ip_output.c:129 [inline]
       __ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527
       __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479
       __tcp_send_ack.part.0+0x3de/0x700 net/ipv4/tcp_output.c:4279
       __tcp_send_ack net/ipv4/tcp_output.c:4285 [inline]
       tcp_send_ack+0x84/0xa0 net/ipv4/tcp_output.c:4285
       tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:6632 [inline]
       tcp_rcv_state_process+0x4236/0x4ed0 net/ipv4/tcp_input.c:6826
       tcp_v4_do_rcv+0x1ad/0xa90 net/ipv4/tcp_ipv4.c:1948
       sk_backlog_rcv include/net/sock.h:1148 [inline]
       __release_sock+0x31b/0x400 net/core/sock.c:3213
       release_sock+0x5a/0x220 net/core/sock.c:3767
       mptcp_connect+0xccd/0xfe0 net/mptcp/protocol.c:3695
       __inet_stream_connect+0x3c8/0x1020 net/ipv4/af_inet.c:677
       inet_stream_connect+0x57/0xa0 net/ipv4/af_inet.c:748
       __sys_connect_file+0x141/0x1a0 net/socket.c:2038
       __sys_connect+0x13b/0x160 net/socket.c:2057
       __do_sys_connect net/socket.c:2063 [inline]
       __se_sys_connect net/socket.c:2060 [inline]
       __x64_sys_connect+0x72/0xb0 net/socket.c:2060
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (k-clock-AF_INET6){++.-}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3168 [inline]
       check_prevs_add kernel/locking/lockdep.c:3287 [inline]
       validate_chain kernel/locking/lockdep.c:3911 [inline]
       __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
       lock_acquire kernel/locking/lockdep.c:5871 [inline]
       lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
       __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]
       _raw_write_lock_bh+0x33/0x40 kernel/locking/spinlock.c:334
       sock_orphan include/net/sock.h:2075 [inline]
       inet_child_forget+0x7e/0x2e0 net/ipv4/inet_connection_sock.c:1383
       inet_csk_listen_stop+0x323/0x1090 net/ipv4/inet_connection_sock.c:1523
       tcp_disconnect+0x18a4/0x1ec0 net/ipv4/tcp.c:3340
       inet_shutdown+0x26f/0x440 net/ipv4/af_inet.c:935
       smc_close_active+0xc2a/0x1070 net/smc/smc_close.c:223
       __smc_release+0x634/0x880 net/smc/af_smc.c:282
       smc_release+0x1fc/0x5f0 net/smc/af_smc.c:349
       __sock_release+0xb3/0x270 net/socket.c:647
       sock_close+0x1c/0x30 net/socket.c:1391
       __fput+0x402/0xb70 fs/file_table.c:465
       task_work_run+0x150/0x240 kernel/task_work.c:227
       resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
       exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
       exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
       syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
       syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
       do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(k-slock-AF_INET6);
                               lock(k-clock-AF_INET6);
                               lock(k-slock-AF_INET6);
  lock(k-clock-AF_INET6);

 *** DEADLOCK ***

4 locks held by syz.3.22/6775:
 #0: ffff888056c4b808 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:869 [inline]
 #0: ffff888056c4b808 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
 #1: ffff8880316dc758 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x378/0x5f0 net/smc/af_smc.c:341
 #2: ffff888031983858 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline]
 #2: ffff888031983858 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_shutdown+0x67/0x440 net/ipv4/af_inet.c:905
 #3: ffff888031980f58 (k-slock-AF_INET6){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #3: ffff888031980f58 (k-slock-AF_INET6){+.-.}-{3:3}, at: inet_csk_listen_stop+0x203/0x1090 net/ipv4/inet_connection_sock.c:1495

stack backtrace:
CPU: 0 UID: 0 PID: 6775 Comm: syz.3.22 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_circular_bug+0x275/0x350 kernel/locking/lockdep.c:2046
 check_noncircular+0x14c/0x170 kernel/locking/lockdep.c:2178
 check_prev_add kernel/locking/lockdep.c:3168 [inline]
 check_prevs_add kernel/locking/lockdep.c:3287 [inline]
 validate_chain kernel/locking/lockdep.c:3911 [inline]
 __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
 lock_acquire kernel/locking/lockdep.c:5871 [inline]
 lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
 __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]
 _raw_write_lock_bh+0x33/0x40 kernel/locking/spinlock.c:334
 sock_orphan include/net/sock.h:2075 [inline]
 inet_child_forget+0x7e/0x2e0 net/ipv4/inet_connection_sock.c:1383
 inet_csk_listen_stop+0x323/0x1090 net/ipv4/inet_connection_sock.c:1523
 tcp_disconnect+0x18a4/0x1ec0 net/ipv4/tcp.c:3340
 inet_shutdown+0x26f/0x440 net/ipv4/af_inet.c:935
 smc_close_active+0xc2a/0x1070 net/smc/smc_close.c:223
 __smc_release+0x634/0x880 net/smc/af_smc.c:282
 smc_release+0x1fc/0x5f0 net/smc/af_smc.c:349
 __sock_release+0xb3/0x270 net/socket.c:647
 sock_close+0x1c/0x30 net/socket.c:1391
 __fput+0x402/0xb70 fs/file_table.c:465
 task_work_run+0x150/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe73c37e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe73d091038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fe73c535f80 RCX: 00007fe73c37e719
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007fe73c3f132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe73c535f80 R15: 00007fff230025e8
 </TASK>


Tested on:

commit:         dfba48a7 Merge tag 'i2c-for-6.16-rc4' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16ce688c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d3e0d55231e0c89c
dashboard link: https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1124c770580000

syztest

[Arnaud Lecomte]

#syz test

--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -126,8 +126,12 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
 	struct smc_sock *smc;
 	struct sock *child;
 
+	lockdep_assert_held_read(&sk->sk_callback_lock);
 	smc = smc_clcsock_user_data(sk);
 
+	if (!smc)
+		goto drop;
+
 	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
 				sk->sk_max_ack_backlog)
 		goto drop;
-- 
2.43.0

Re: [syzbot] [smc?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in smc_tcp_syn_recv_sock

------------[ cut here ]------------
WARNING: CPU: 1 PID: 6792 at net/smc/af_smc.c:129 smc_tcp_syn_recv_sock+0x3f8/0x570 net/smc/af_smc.c:129
Modules linked in:
CPU: 1 UID: 0 PID: 6792 Comm: syz.1.16 Not tainted 6.16.0-rc3-syzkaller-gdfba48a70cb6-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:smc_tcp_syn_recv_sock+0x3f8/0x570 net/smc/af_smc.c:129
Code: 48 8d bb f0 03 00 00 be 01 00 00 00 e8 21 c0 57 00 31 ff 89 c5 89 c6 e8 96 88 a2 f6 85 ed 0f 85 81 fc ff ff e8 49 8d a2 f6 90 <0f> 0b 90 e9 73 fc ff ff e8 3b 8d a2 f6 4c 89 fa 48 b8 00 00 00 00
RSP: 0018:ffffc90000a08780 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888034d95e80 RCX: ffffffff8b198ffa
RDX: ffff88802825da00 RSI: ffffffff8b199007 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff8880352e89e0 R14: ffffc90000a08850 R15: ffff888034d95e80
FS:  00007fba98e0c6c0(0000) GS:ffff888124ab5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000040 CR3: 0000000032bf6000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 tcp_check_req+0x69d/0x1f80 net/ipv4/tcp_minisocks.c:874
 tcp_v4_rcv+0x19b0/0x4650 net/ipv4/tcp_ipv4.c:2283
 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:317 [inline]
 NF_HOOK include/linux/netfilter.h:311 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:469 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:447 [inline]
 NF_HOOK include/linux/netfilter.h:317 [inline]
 NF_HOOK include/linux/netfilter.h:311 [inline]
 ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:567
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5977
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6090
 process_backlog+0x442/0x15e0 net/core/dev.c:6442
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7414
 napi_poll net/core/dev.c:7478 [inline]
 net_rx_action+0xa9f/0xfe0 net/core/dev.c:7605
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 do_softirq kernel/softirq.c:480 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:467
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:407
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
 __dev_queue_xmit+0x8ab/0x43e0 net/core/dev.c:4740
 dev_queue_xmit include/linux/netdevice.h:3355 [inline]
 neigh_hh_output include/net/neighbour.h:523 [inline]
 neigh_output include/net/neighbour.h:537 [inline]
 ip_finish_output2+0xc38/0x21a0 net/ipv4/ip_output.c:235
 __ip_finish_output net/ipv4/ip_output.c:313 [inline]
 __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:295
 ip_finish_output+0x35/0x380 net/ipv4/ip_output.c:323
 NF_HOOK_COND include/linux/netfilter.h:306 [inline]
 ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433
 dst_output include/net/dst.h:459 [inline]
 ip_local_out net/ipv4/ip_output.c:129 [inline]
 __ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527
 __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479
 __tcp_send_ack.part.0+0x3de/0x700 net/ipv4/tcp_output.c:4279
 __tcp_send_ack net/ipv4/tcp_output.c:4285 [inline]
 tcp_send_ack+0x84/0xa0 net/ipv4/tcp_output.c:4285
 tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:6632 [inline]
 tcp_rcv_state_process+0x4236/0x4ed0 net/ipv4/tcp_input.c:6826
 tcp_v4_do_rcv+0x1ad/0xa90 net/ipv4/tcp_ipv4.c:1948
 sk_backlog_rcv include/net/sock.h:1148 [inline]
 __release_sock+0x31b/0x400 net/core/sock.c:3213
 release_sock+0x5a/0x220 net/core/sock.c:3767
 mptcp_connect+0xccd/0xfe0 net/mptcp/protocol.c:3695
 __inet_stream_connect+0x3c8/0x1020 net/ipv4/af_inet.c:677
 inet_stream_connect+0x57/0xa0 net/ipv4/af_inet.c:748
 __sys_connect_file+0x141/0x1a0 net/socket.c:2038
 __sys_connect+0x13b/0x160 net/socket.c:2057
 __do_sys_connect net/socket.c:2063 [inline]
 __se_sys_connect net/socket.c:2060 [inline]
 __x64_sys_connect+0x72/0xb0 net/socket.c:2060
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fba97f7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fba98e0c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007fba98135f80 RCX: 00007fba97f7e719
RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007fba97ff132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fba98135f80 R15: 00007ffdbf9fe0b8
 </TASK>


Tested on:

commit:         dfba48a7 Merge tag 'i2c-for-6.16-rc4' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1622a982580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d3e0d55231e0c89c
dashboard link: https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1097888c580000

syztest

[Arnaud Lecomte]

#syz test

--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -125,9 +125,12 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
 {
 	struct smc_sock *smc;
 	struct sock *child;
-
+	read_lock_bh(&((struct sock *)sk)->sk_callback_lock);
 	smc = smc_clcsock_user_data(sk);
 
+	if (!smc)
+		goto drop;
+
 	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
 				sk->sk_max_ack_backlog)
 		goto drop;
@@ -148,9 +151,11 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
 		if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
 			inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
 	}
+	read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
 	return child;
 
 drop:
+	read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
 	dst_release(dst);
 	tcp_listendrop(sk);
 	return NULL;
-- 
2.43.0

Re: [syzbot] [smc?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in inet_child_forget

======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc3-syzkaller-gdfba48a70cb6-dirty #0 Not tainted
------------------------------------------------------
syz.2.23/6591 is trying to acquire lock:
ffff88805b87ac70 (k-clock-AF_INET6){++.-}-{3:3}, at: sock_orphan include/net/sock.h:2075 [inline]
ffff88805b87ac70 (k-clock-AF_INET6){++.-}-{3:3}, at: inet_child_forget+0x7e/0x2e0 net/ipv4/inet_connection_sock.c:1383

but task is already holding lock:
ffff88805b87aa58 (k-slock-AF_INET6){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
ffff88805b87aa58 (k-slock-AF_INET6){+.-.}-{3:3}, at: inet_csk_listen_stop+0x203/0x1090 net/ipv4/inet_connection_sock.c:1495

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (k-slock-AF_INET6){+.-.}-{3:3}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
       _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
       spin_lock include/linux/spinlock.h:351 [inline]
       sk_clone_lock+0x334/0x1330 net/core/sock.c:2499
       inet_csk_clone_lock+0x2a/0x750 net/ipv4/inet_connection_sock.c:1232
       tcp_create_openreq_child+0x34/0x1980 net/ipv4/tcp_minisocks.c:526
       tcp_v4_syn_recv_sock+0x115/0x1250 net/ipv4/tcp_ipv4.c:1774
       tcp_v6_syn_recv_sock+0x1353/0x2480 net/ipv6/tcp_ipv6.c:1382
       smc_tcp_syn_recv_sock+0x24b/0x500 net/smc/af_smc.c:144
       tcp_check_req+0x69d/0x1f80 net/ipv4/tcp_minisocks.c:874
       tcp_v4_rcv+0x19b0/0x4650 net/ipv4/tcp_ipv4.c:2283
       ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
       ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
       NF_HOOK include/linux/netfilter.h:317 [inline]
       NF_HOOK include/linux/netfilter.h:311 [inline]
       ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
       dst_input include/net/dst.h:469 [inline]
       ip_rcv_finish net/ipv4/ip_input.c:447 [inline]
       NF_HOOK include/linux/netfilter.h:317 [inline]
       NF_HOOK include/linux/netfilter.h:311 [inline]
       ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:567
       __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5977
       __netif_receive_skb+0x1d/0x160 net/core/dev.c:6090
       process_backlog+0x442/0x15e0 net/core/dev.c:6442
       __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7414
       napi_poll net/core/dev.c:7478 [inline]
       net_rx_action+0xa9f/0xfe0 net/core/dev.c:7605
       handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
       do_softirq kernel/softirq.c:480 [inline]
       do_softirq+0xb2/0xf0 kernel/softirq.c:467
       __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:407
       local_bh_enable include/linux/bottom_half.h:33 [inline]
       rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
       __dev_queue_xmit+0x8ab/0x43e0 net/core/dev.c:4740
       dev_queue_xmit include/linux/netdevice.h:3355 [inline]
       neigh_hh_output include/net/neighbour.h:523 [inline]
       neigh_output include/net/neighbour.h:537 [inline]
       ip_finish_output2+0xc38/0x21a0 net/ipv4/ip_output.c:235
       __ip_finish_output net/ipv4/ip_output.c:313 [inline]
       __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:295
       ip_finish_output+0x35/0x380 net/ipv4/ip_output.c:323
       NF_HOOK_COND include/linux/netfilter.h:306 [inline]
       ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433
       dst_output include/net/dst.h:459 [inline]
       ip_local_out net/ipv4/ip_output.c:129 [inline]
       __ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527
       __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479
       __tcp_send_ack.part.0+0x3de/0x700 net/ipv4/tcp_output.c:4279
       __tcp_send_ack net/ipv4/tcp_output.c:4285 [inline]
       tcp_send_ack+0x84/0xa0 net/ipv4/tcp_output.c:4285
       tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:6632 [inline]
       tcp_rcv_state_process+0x4236/0x4ed0 net/ipv4/tcp_input.c:6826
       tcp_v4_do_rcv+0x1ad/0xa90 net/ipv4/tcp_ipv4.c:1948
       sk_backlog_rcv include/net/sock.h:1148 [inline]
       __release_sock+0x31b/0x400 net/core/sock.c:3213
       release_sock+0x5a/0x220 net/core/sock.c:3767
       mptcp_connect+0xccd/0xfe0 net/mptcp/protocol.c:3695
       __inet_stream_connect+0x3c8/0x1020 net/ipv4/af_inet.c:677
       inet_stream_connect+0x57/0xa0 net/ipv4/af_inet.c:748
       __sys_connect_file+0x141/0x1a0 net/socket.c:2038
       __sys_connect+0x13b/0x160 net/socket.c:2057
       __do_sys_connect net/socket.c:2063 [inline]
       __se_sys_connect net/socket.c:2060 [inline]
       __x64_sys_connect+0x72/0xb0 net/socket.c:2060
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (k-clock-AF_INET6){++.-}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3168 [inline]
       check_prevs_add kernel/locking/lockdep.c:3287 [inline]
       validate_chain kernel/locking/lockdep.c:3911 [inline]
       __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
       lock_acquire kernel/locking/lockdep.c:5871 [inline]
       lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
       __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]
       _raw_write_lock_bh+0x33/0x40 kernel/locking/spinlock.c:334
       sock_orphan include/net/sock.h:2075 [inline]
       inet_child_forget+0x7e/0x2e0 net/ipv4/inet_connection_sock.c:1383
       inet_csk_listen_stop+0x323/0x1090 net/ipv4/inet_connection_sock.c:1523
       tcp_disconnect+0x18a4/0x1ec0 net/ipv4/tcp.c:3340
       inet_shutdown+0x26f/0x440 net/ipv4/af_inet.c:935
       smc_close_active+0xc2a/0x1070 net/smc/smc_close.c:223
       __smc_release+0x634/0x880 net/smc/af_smc.c:282
       smc_release+0x1fc/0x5f0 net/smc/af_smc.c:349
       __sock_release+0xb3/0x270 net/socket.c:647
       sock_close+0x1c/0x30 net/socket.c:1391
       __fput+0x402/0xb70 fs/file_table.c:465
       task_work_run+0x150/0x240 kernel/task_work.c:227
       resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
       exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
       exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
       syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
       syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
       do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(k-slock-AF_INET6);
                               lock(k-clock-AF_INET6);
                               lock(k-slock-AF_INET6);
  lock(k-clock-AF_INET6);

 *** DEADLOCK ***

4 locks held by syz.2.23/6591:
 #0: ffff88805b065608 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:869 [inline]
 #0: ffff88805b065608 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
 #1: ffff888058b0a4d8 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x378/0x5f0 net/smc/af_smc.c:341
 #2: ffff88805b878fd8 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline]
 #2: ffff88805b878fd8 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_shutdown+0x67/0x440 net/ipv4/af_inet.c:905
 #3: ffff88805b87aa58 (k-slock-AF_INET6){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #3: ffff88805b87aa58 (k-slock-AF_INET6){+.-.}-{3:3}, at: inet_csk_listen_stop+0x203/0x1090 net/ipv4/inet_connection_sock.c:1495

stack backtrace:
CPU: 0 UID: 0 PID: 6591 Comm: syz.2.23 Not tainted 6.16.0-rc3-syzkaller-gdfba48a70cb6-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_circular_bug+0x275/0x350 kernel/locking/lockdep.c:2046
 check_noncircular+0x14c/0x170 kernel/locking/lockdep.c:2178
 check_prev_add kernel/locking/lockdep.c:3168 [inline]
 check_prevs_add kernel/locking/lockdep.c:3287 [inline]
 validate_chain kernel/locking/lockdep.c:3911 [inline]
 __lock_acquire+0x126f/0x1c90 kernel/locking/lockdep.c:5240
 lock_acquire kernel/locking/lockdep.c:5871 [inline]
 lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
 __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]
 _raw_write_lock_bh+0x33/0x40 kernel/locking/spinlock.c:334
 sock_orphan include/net/sock.h:2075 [inline]
 inet_child_forget+0x7e/0x2e0 net/ipv4/inet_connection_sock.c:1383
 inet_csk_listen_stop+0x323/0x1090 net/ipv4/inet_connection_sock.c:1523
 tcp_disconnect+0x18a4/0x1ec0 net/ipv4/tcp.c:3340
 inet_shutdown+0x26f/0x440 net/ipv4/af_inet.c:935
 smc_close_active+0xc2a/0x1070 net/smc/smc_close.c:223
 __smc_release+0x634/0x880 net/smc/af_smc.c:282
 smc_release+0x1fc/0x5f0 net/smc/af_smc.c:349
 __sock_release+0xb3/0x270 net/socket.c:647
 sock_close+0x1c/0x30 net/socket.c:1391
 __fput+0x402/0xb70 fs/file_table.c:465
 task_work_run+0x150/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fec9fd7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fec9effe038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fec9ff35f80 RCX: 00007fec9fd7e719
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007fec9fdf132e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fec9ff35f80 R15: 00007ffd574ead88
 </TASK>


Tested on:

commit:         dfba48a7 Merge tag 'i2c-for-6.16-rc4' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11cd688c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d3e0d55231e0c89c
dashboard link: https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10e2a982580000

Re: [syzbot] [rdma?] [s390?] [net?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[Hillf Danton]

> Date: Mon, 31 Mar 2025 13:23:20 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    850925a8133c Merge tag '9p-for-6.12-rc5' of https://github..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1227aa87980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=17c0d505695d6b0
> dashboard link: https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15489230580000

#syz test upstream   master

--- x/net/smc/af_smc.c
+++ y/net/smc/af_smc.c
@@ -127,6 +127,8 @@ static struct sock *smc_tcp_syn_recv_soc
 	struct sock *child;
 
 	smc = smc_clcsock_user_data(sk);
+	if (!smc)
+		goto drop;
 
 	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
 				sk->sk_max_ack_backlog)
--

Re: [syzbot] [smc?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+827ae2bfb3a3529333e9@syzkaller.appspotmail.com
Tested-by: syzbot+827ae2bfb3a3529333e9@syzkaller.appspotmail.com

Tested on:

commit:         d0b3b7b2 Linux 6.16-rc4
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11da6982580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=31697df50f24445
dashboard link: https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15b963d4580000

Note: testing is done by a robot and is best-effort only.

Re: syztest

[Paolo Abeni]

On 6/29/25 3:29 PM, Arnaud Lecomte wrote:
> #syz test
> 
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -123,11 +123,14 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
>  					  struct request_sock *req_unhash,
>  					  bool *own_req)
>  {
> +        read_lock_bh(&((struct sock *)sk)->sk_callback_lock);
>  	struct smc_sock *smc;
>  	struct sock *child;
> -
>  	smc = smc_clcsock_user_data(sk);
>  
> +	if (!smc)
> +		goto drop;
> +
>  	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
>  				sk->sk_max_ack_backlog)
>  		goto drop;
> @@ -148,9 +151,11 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
>  		if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
>  			inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
>  	}
> +	read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
>  	return child;
>  
>  drop:
> +	read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
>  	dst_release(dst);
>  	tcp_listendrop(sk);
>  	return NULL;
> @@ -2613,7 +2618,7 @@ int smc_listen(struct socket *sock, int backlog)
>  	int rc;
>  
>  	smc = smc_sk(sk);
> -	lock_sock(sk);
> +	lock_sock(sock->sk);
>  
>  	rc = -EINVAL;
>  	if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) ||

Please stop cc-ing netdev and other kernel ML with this tests. You
should keep just the syzkaller related MLs and a very restricted list of
individuals (i.e. no maintainers).

Thanks,

Paolo

Re: [syzbot] [smc?] KASAN: null-ptr-deref Read in smc_tcp_syn_recv_sock

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    db9030a787e3 Merge remote-tracking branch 'will/for-next/p..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=167bc97c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=fdc83aa8a8b9d1ae
dashboard link: https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10496884580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14da2692580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8932d8648ef5/disk-db9030a7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8446b6e4ef5c/vmlinux-db9030a7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b17118b94e44/Image-db9030a7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+827ae2bfb3a3529333e9@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in smc_tcp_syn_recv_sock+0x84/0x574 net/smc/af_smc.c:134
Read of size 4 at addr 0000000000000acc by task syz.0.42/6792

CPU: 1 UID: 0 PID: 6792 Comm: syz.0.42 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_report+0x58/0x84 mm/kasan/report.c:485
 kasan_report+0xb0/0x110 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:200
 __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 smc_tcp_syn_recv_sock+0x84/0x574 net/smc/af_smc.c:134
 tcp_check_req+0xf6c/0x18e8 net/ipv4/tcp_minisocks.c:912
 tcp_v6_rcv+0xf50/0x2460 net/ipv6/tcp_ipv6.c:1845
 ip6_protocol_deliver_rcu+0x9a4/0x12d4 net/ipv6/ip6_input.c:438
 ip6_input_finish+0x154/0x350 net/ipv6/ip6_input.c:489
 NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:318
 ip6_input+0x15c/0x270 net/ipv6/ip6_input.c:500
 dst_input include/net/dst.h:474 [inline]
 ip6_rcv_finish+0x1f0/0x21c net/ipv6/ip6_input.c:79
 NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:318
 ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core net/core/dev.c:6079 [inline]
 __netif_receive_skb+0xcc/0x2a8 net/core/dev.c:6192
 process_backlog+0x60c/0x10e4 net/core/dev.c:6544
 __napi_poll+0xb4/0x310 net/core/dev.c:7594
 napi_poll net/core/dev.c:7657 [inline]
 net_rx_action+0x548/0xd00 net/core/dev.c:7784
 handle_softirqs+0x328/0xc88 kernel/softirq.c:622
 __do_softirq+0x14/0x20 kernel/softirq.c:656
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
 do_softirq+0x90/0xf8 kernel/softirq.c:523
 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450
 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
 rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline]
 __dev_queue_xmit+0x17ac/0x32a8 net/core/dev.c:4790
 dev_queue_xmit include/linux/netdevice.h:3365 [inline]
 neigh_hh_output include/net/neighbour.h:531 [inline]
 neigh_output include/net/neighbour.h:545 [inline]
 ip6_finish_output2+0x1150/0x1a78 net/ipv6/ip6_output.c:136
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x418/0x7b4 net/ipv6/ip6_output.c:220
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x2c8/0x640 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:464 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 ip6_xmit+0x1134/0x1a20 net/ipv6/ip6_output.c:371
 inet6_csk_xmit+0x454/0x66c net/ipv6/inet6_connection_sock.c:120
 __tcp_transmit_skb+0x1a34/0x3214 net/ipv4/tcp_output.c:1628
 tcp_transmit_skb net/ipv4/tcp_output.c:1646 [inline]
 tcp_write_xmit+0x159c/0x52a4 net/ipv4/tcp_output.c:2999
 __tcp_push_pending_frames net/ipv4/tcp_output.c:3182 [inline]
 tcp_send_fin+0x620/0xc08 net/ipv4/tcp_output.c:3800
 __tcp_close+0x558/0xf68 net/ipv4/tcp.c:3207
 tcp_close+0x38/0x144 net/ipv4/tcp.c:3298
 inet_release+0x154/0x1d0 net/ipv4/af_inet.c:437
 inet6_release+0x5c/0x78 net/ipv6/af_inet6.c:487
 __sock_release net/socket.c:662 [inline]
 sock_close+0xa0/0x1e4 net/socket.c:1455
 __fput+0x340/0x75c fs/file_table.c:468
 ____fput+0x20/0x58 fs/file_table.c:496
 task_work_run+0x1dc/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xfc/0x178 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 arm64_exit_to_user_mode arch/arm64/kernel/entry-common.c:81 [inline]
 el0_svc+0x170/0x254 arch/arm64/kernel/entry-common.c:725
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
==================================================================
Unable to handle kernel paging request at virtual address dfff800000000159
KASAN: null-ptr-deref in range [0x0000000000000ac8-0x0000000000000acf]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000159] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6792 Comm: syz.0.42 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
pc : atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
pc : smc_tcp_syn_recv_sock+0x88/0x574 net/smc/af_smc.c:134
lr : instrument_atomic_read include/linux/instrumented.h:68 [inline]
lr : atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
lr : smc_tcp_syn_recv_sock+0x84/0x574 net/smc/af_smc.c:134
sp : ffff800097937340
x29: ffff800097937340 x28: 0000000000000000 x27: dfff800000000000
x26: 0000000000000000 x25: 0000000000000acc x24: ffff0000cdd47270
x23: ffff0000d72a7a00 x22: ffff0000d72a7a00 x21: ffff800097937480
x20: 0000000000000000 x19: ffff0000c7c80000 x18: 0000000000000000
x17: 3d3d3d3d3d3d3d3d x16: ffff800082debe40 x15: 0000000000000001
x14: 1ffff000125cd314 x13: 0000000000000000 x12: 0000000000000000
x11: ffff7000125cd315 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000159 x7 : 0000000000000001 x6 : ffff8000805653c0
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000803c084c
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] (P)
 atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] (P)
 smc_tcp_syn_recv_sock+0x88/0x574 net/smc/af_smc.c:134 (P)
 tcp_check_req+0xf6c/0x18e8 net/ipv4/tcp_minisocks.c:912
 tcp_v6_rcv+0xf50/0x2460 net/ipv6/tcp_ipv6.c:1845
 ip6_protocol_deliver_rcu+0x9a4/0x12d4 net/ipv6/ip6_input.c:438
 ip6_input_finish+0x154/0x350 net/ipv6/ip6_input.c:489
 NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:318
 ip6_input+0x15c/0x270 net/ipv6/ip6_input.c:500
 dst_input include/net/dst.h:474 [inline]
 ip6_rcv_finish+0x1f0/0x21c net/ipv6/ip6_input.c:79
 NF_HOOK+0x2c4/0x358 include/linux/netfilter.h:318
 ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core net/core/dev.c:6079 [inline]
 __netif_receive_skb+0xcc/0x2a8 net/core/dev.c:6192
 process_backlog+0x60c/0x10e4 net/core/dev.c:6544
 __napi_poll+0xb4/0x310 net/core/dev.c:7594
 napi_poll net/core/dev.c:7657 [inline]
 net_rx_action+0x548/0xd00 net/core/dev.c:7784
 handle_softirqs+0x328/0xc88 kernel/softirq.c:622
 __do_softirq+0x14/0x20 kernel/softirq.c:656
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
 do_softirq+0x90/0xf8 kernel/softirq.c:523
 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450
 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
 rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline]
 __dev_queue_xmit+0x17ac/0x32a8 net/core/dev.c:4790
 dev_queue_xmit include/linux/netdevice.h:3365 [inline]
 neigh_hh_output include/net/neighbour.h:531 [inline]
 neigh_output include/net/neighbour.h:545 [inline]
 ip6_finish_output2+0x1150/0x1a78 net/ipv6/ip6_output.c:136
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x418/0x7b4 net/ipv6/ip6_output.c:220
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x2c8/0x640 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:464 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 ip6_xmit+0x1134/0x1a20 net/ipv6/ip6_output.c:371
 inet6_csk_xmit+0x454/0x66c net/ipv6/inet6_connection_sock.c:120
 __tcp_transmit_skb+0x1a34/0x3214 net/ipv4/tcp_output.c:1628
 tcp_transmit_skb net/ipv4/tcp_output.c:1646 [inline]
 tcp_write_xmit+0x159c/0x52a4 net/ipv4/tcp_output.c:2999
 __tcp_push_pending_frames net/ipv4/tcp_output.c:3182 [inline]
 tcp_send_fin+0x620/0xc08 net/ipv4/tcp_output.c:3800
 __tcp_close+0x558/0xf68 net/ipv4/tcp.c:3207
 tcp_close+0x38/0x144 net/ipv4/tcp.c:3298
 inet_release+0x154/0x1d0 net/ipv4/af_inet.c:437
 inet6_release+0x5c/0x78 net/ipv6/af_inet6.c:487
 __sock_release net/socket.c:662 [inline]
 sock_close+0xa0/0x1e4 net/socket.c:1455
 __fput+0x340/0x75c fs/file_table.c:468
 ____fput+0x20/0x58 fs/file_table.c:496
 task_work_run+0x1dc/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xfc/0x178 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 arm64_exit_to_user_mode arch/arm64/kernel/entry-common.c:81 [inline]
 el0_svc+0x170/0x254 arch/arm64/kernel/entry-common.c:725
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Code: 52800081 aa1903e0 9761d4da d343ff28 (38fb6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	52800081 	mov	w1, #0x4                   	// #4
   4:	aa1903e0 	mov	x0, x25
   8:	9761d4da 	bl	0xfffffffffd875370
   c:	d343ff28 	lsr	x8, x25, #3
* 10:	38fb6908 	ldrsb	w8, [x8, x27] <-- trapping instruction


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: syztest

[Lecomte, Arnaud]

On 04/09/2025 16:47, Jakub Kicinski wrote:
> On Thu,  4 Sep 2025 16:11:13 +0200 Arnaud Lecomte wrote:
>> #syz test
> You are hereby encouraged to not CC the vger MLs on your attempts
> to get your patches tested by syzbot. It's not necessary.
>
Hey, sorry for the inconvenience.
Will be removed.

Re: syztest

[Jakub Kicinski]

On Thu,  4 Sep 2025 16:11:13 +0200 Arnaud Lecomte wrote:
> #syz test

You are hereby encouraged to not CC the vger MLs on your attempts 
to get your patches tested by syzbot. It's not necessary.

syztest

[Arnaud Lecomte]

#syz test

diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 3615c06b7dfa..1389712bc1df 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -42,6 +42,28 @@ static inline int stack_map_data_size(struct bpf_map *map)
 		sizeof(struct bpf_stack_build_id) : sizeof(u64);
 }
 
+/**
+ * stack_map_calculate_max_depth - Calculate maximum allowed stack trace depth
+ * @size:  Size of the buffer/map value in bytes
+ * @elem_size:  Size of each stack trace element
+ * @flags:  BPF stack trace flags (BPF_F_USER_STACK, BPF_F_USER_BUILD_ID, ...)
+ *
+ * Return: Maximum number of stack trace entries that can be safely stored
+ */
+static u32 stack_map_calculate_max_depth(u32 size, u32 elem_size, u64 flags)
+{
+	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+	u32 max_depth;
+	u32 curr_sysctl_max_stack = READ_ONCE(sysctl_perf_event_max_stack);
+
+	max_depth = size / elem_size;
+	max_depth += skip;
+	if (max_depth > curr_sysctl_max_stack)
+		return curr_sysctl_max_stack;
+
+	return max_depth;
+}
+
 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
 {
 	u64 elem_size = sizeof(struct stack_map_bucket) +
@@ -300,22 +322,20 @@ static long __bpf_get_stackid(struct bpf_map *map,
 BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
 	   u64, flags)
 {
-	u32 max_depth = map->value_size / stack_map_data_size(map);
-	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+	u32 elem_size = stack_map_data_size(map);
 	bool user = flags & BPF_F_USER_STACK;
 	struct perf_callchain_entry *trace;
 	bool kernel = !user;
+	u32 max_depth;
 
 	if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
 			       BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
 		return -EINVAL;
 
-	max_depth += skip;
-	if (max_depth > sysctl_perf_event_max_stack)
-		max_depth = sysctl_perf_event_max_stack;
-
+	max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags);
 	trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
 				   false, false);
+	trace->nr = min_t(u32, trace->nr, max_depth);
 
 	if (unlikely(!trace))
 		/* couldn't fetch the stack trace */
@@ -350,6 +370,7 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
 {
 	struct perf_event *event = ctx->event;
 	struct perf_callchain_entry *trace;
+	u32 elem_size, max_depth;
 	bool kernel, user;
 	__u64 nr_kernel;
 	int ret;
@@ -371,11 +392,15 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
 		return -EFAULT;
 
 	nr_kernel = count_kernel_ip(trace);
+	elem_size = stack_map_data_size(map);
 
 	if (kernel) {
 		__u64 nr = trace->nr;
 
 		trace->nr = nr_kernel;
+		max_depth =
+			stack_map_calculate_max_depth(map->value_size, elem_size, flags);
+		trace->nr = min_t(u32, nr_kernel, max_depth);
 		ret = __bpf_get_stackid(map, trace, flags);
 
 		/* restore nr */
@@ -388,6 +413,9 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
 			return -EFAULT;
 
 		flags = (flags & ~BPF_F_SKIP_FIELD_MASK) | skip;
+		max_depth =
+			stack_map_calculate_max_depth(map->value_size, elem_size, flags);
+		trace->nr = min_t(u32, trace->nr, max_depth);
 		ret = __bpf_get_stackid(map, trace, flags);
 	}
 	return ret;
@@ -406,8 +434,8 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 			    struct perf_callchain_entry *trace_in,
 			    void *buf, u32 size, u64 flags, bool may_fault)
 {
-	u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
 	bool user_build_id = flags & BPF_F_USER_BUILD_ID;
+	u32 trace_nr, copy_len, elem_size, max_depth;
 	bool crosstask = task && task != current;
 	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
 	bool user = flags & BPF_F_USER_STACK;
@@ -438,21 +466,20 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 		goto clear;
 	}
 
-	num_elem = size / elem_size;
-	max_depth = num_elem + skip;
-	if (sysctl_perf_event_max_stack < max_depth)
-		max_depth = sysctl_perf_event_max_stack;
+	max_depth = stack_map_calculate_max_depth(size, elem_size, flags);
 
 	if (may_fault)
 		rcu_read_lock(); /* need RCU for perf's callchain below */
 
-	if (trace_in)
+	if (trace_in) {
 		trace = trace_in;
-	else if (kernel && task)
+		trace->nr = min_t(u32, trace->nr, max_depth);
+	} else if (kernel && task) {
 		trace = get_callchain_entry_for_task(task, max_depth);
-	else
+	} else {
 		trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
 					   crosstask, false);
+	}
 
 	if (unlikely(!trace) || trace->nr < skip) {
 		if (may_fault)
@@ -461,7 +488,6 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 	}
 
 	trace_nr = trace->nr - skip;
-	trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
 	copy_len = trace_nr * elem_size;
 
 	ips = trace->ip + skip;
-- 
2.47.3

syztest

[Arnaud Lecomte]

#syz test

diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 3615c06b7dfa..29e05c9ff1bd 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -42,6 +42,28 @@ static inline int stack_map_data_size(struct bpf_map *map)
 		sizeof(struct bpf_stack_build_id) : sizeof(u64);
 }
 
+/**
+ * stack_map_calculate_max_depth - Calculate maximum allowed stack trace depth
+ * @size:  Size of the buffer/map value in bytes
+ * @elem_size:  Size of each stack trace element
+ * @flags:  BPF stack trace flags (BPF_F_USER_STACK, BPF_F_USER_BUILD_ID, ...)
+ *
+ * Return: Maximum number of stack trace entries that can be safely stored
+ */
+static u32 stack_map_calculate_max_depth(u32 size, u32 elem_size, u64 flags)
+{
+	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+	u32 max_depth;
+	u32 curr_sysctl_max_stack = READ_ONCE(sysctl_perf_event_max_stack);
+
+	max_depth = size / elem_size;
+	max_depth += skip;
+	if (max_depth > curr_sysctl_max_stack)
+		return curr_sysctl_max_stack;
+
+	return max_depth;
+}
+
 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
 {
 	u64 elem_size = sizeof(struct stack_map_bucket) +
@@ -300,20 +322,17 @@ static long __bpf_get_stackid(struct bpf_map *map,
 BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
 	   u64, flags)
 {
-	u32 max_depth = map->value_size / stack_map_data_size(map);
-	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+	u32 elem_size = stack_map_data_size(map);
 	bool user = flags & BPF_F_USER_STACK;
 	struct perf_callchain_entry *trace;
 	bool kernel = !user;
+	u32 max_depth;
 
 	if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
 			       BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
 		return -EINVAL;
 
-	max_depth += skip;
-	if (max_depth > sysctl_perf_event_max_stack)
-		max_depth = sysctl_perf_event_max_stack;
-
+	max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags);
 	trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
 				   false, false);
 
@@ -350,6 +369,7 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
 {
 	struct perf_event *event = ctx->event;
 	struct perf_callchain_entry *trace;
+	u32 elem_size, max_depth;
 	bool kernel, user;
 	__u64 nr_kernel;
 	int ret;
@@ -371,11 +391,15 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
 		return -EFAULT;
 
 	nr_kernel = count_kernel_ip(trace);
+	elem_size = stack_map_data_size(map);
 
 	if (kernel) {
 		__u64 nr = trace->nr;
 
 		trace->nr = nr_kernel;
+		max_depth =
+			stack_map_calculate_max_depth(map->value_size, elem_size, flags);
+		trace->nr = min_t(u32, nr_kernel, max_depth);
 		ret = __bpf_get_stackid(map, trace, flags);
 
 		/* restore nr */
@@ -388,6 +412,9 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
 			return -EFAULT;
 
 		flags = (flags & ~BPF_F_SKIP_FIELD_MASK) | skip;
+		max_depth =
+			stack_map_calculate_max_depth(map->value_size, elem_size, flags);
+		trace->nr = min_t(u32, trace->nr, max_depth);
 		ret = __bpf_get_stackid(map, trace, flags);
 	}
 	return ret;
@@ -406,8 +433,8 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 			    struct perf_callchain_entry *trace_in,
 			    void *buf, u32 size, u64 flags, bool may_fault)
 {
-	u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
 	bool user_build_id = flags & BPF_F_USER_BUILD_ID;
+	u32 trace_nr, copy_len, elem_size, max_depth;
 	bool crosstask = task && task != current;
 	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
 	bool user = flags & BPF_F_USER_STACK;
@@ -438,21 +465,20 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 		goto clear;
 	}
 
-	num_elem = size / elem_size;
-	max_depth = num_elem + skip;
-	if (sysctl_perf_event_max_stack < max_depth)
-		max_depth = sysctl_perf_event_max_stack;
+	max_depth = stack_map_calculate_max_depth(size, elem_size, flags);
 
 	if (may_fault)
 		rcu_read_lock(); /* need RCU for perf's callchain below */
 
-	if (trace_in)
+	if (trace_in) {
 		trace = trace_in;
-	else if (kernel && task)
+		trace->nr = min_t(u32, trace->nr, max_depth);
+	} else if (kernel && task) {
 		trace = get_callchain_entry_for_task(task, max_depth);
-	else
+	} else {
 		trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
 					   crosstask, false);
+	}
 
 	if (unlikely(!trace) || trace->nr < skip) {
 		if (may_fault)
@@ -461,7 +487,6 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
 	}
 
 	trace_nr = trace->nr - skip;
-	trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
 	copy_len = trace_nr * elem_size;
 
 	ips = trace->ip + skip;
-- 
2.47.3

syztest

[Chenzhi Yang]

From: Yang Chenzhi <yang.chenzhi@vivo.com>

#syz test

--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -522,6 +522,7 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid)
 		tree->node_hash[hash] = node;
 		tree->node_hash_cnt++;
 	} else {
+		hfs_bnode_get(node2);
 		spin_unlock(&tree->hash_lock);
 		kfree(node);
 		wait_event(node2->lock_wq,
-- 
2.43.0

Re: syztest

[Arnaud Lecomte]

On 30/07/2025 07:09, Yu Kuai wrote:
> Hi,
>
> 在 2025/07/30 13:51, Arnaud Lecomte 写道:
>> #syz test
>>
>> --- a/drivers/md/md.c
>> +++ b/drivers/md/md.c
>> @@ -5978,10 +5978,6 @@ struct mddev *md_alloc(dev_t dev, char *name)
>>         disk->events |= DISK_EVENT_MEDIA_CHANGE;
>>       mddev->gendisk = disk;
>> -    error = add_disk(disk);
>> -    if (error)
>> -        goto out_put_disk;
>> -
>>       kobject_init(&mddev->kobj, &md_ktype);
>>       error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, 
>> "%s", "md");
>
> This is wrong, you can't add mddev >kobj under the disk without
> kobject_add for the disk kobj.
>
Will dive a bit more into that after work,
Thanks

> Thanks,
> Kuai
>
>>       if (error) {
>> @@ -5999,6 +5995,9 @@ struct mddev *md_alloc(dev_t dev, char *name)
>>       kobject_uevent(&mddev->kobj, KOBJ_ADD);
>>       mddev->sysfs_state = sysfs_get_dirent_safe(mddev->kobj.sd, 
>> "array_state");
>>       mddev->sysfs_level = sysfs_get_dirent_safe(mddev->kobj.sd, 
>> "level");
>> +    error = add_disk(disk);
>> +    if (error)
>> +        goto out_put_disk;
>>       mutex_unlock(&disks_mutex);
>>       return mddev;
>>
>

Re: syztest

[Yu Kuai]

Hi,

在 2025/07/30 13:51, Arnaud Lecomte 写道:
> #syz test
> 
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -5978,10 +5978,6 @@ struct mddev *md_alloc(dev_t dev, char *name)
>   
>   	disk->events |= DISK_EVENT_MEDIA_CHANGE;
>   	mddev->gendisk = disk;
> -	error = add_disk(disk);
> -	if (error)
> -		goto out_put_disk;
> -
>   	kobject_init(&mddev->kobj, &md_ktype);
>   	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");

This is wrong, you can't add mddev >kobj under the disk without
kobject_add for the disk kobj.

Thanks,
Kuai

>   	if (error) {
> @@ -5999,6 +5995,9 @@ struct mddev *md_alloc(dev_t dev, char *name)
>   	kobject_uevent(&mddev->kobj, KOBJ_ADD);
>   	mddev->sysfs_state = sysfs_get_dirent_safe(mddev->kobj.sd, "array_state");
>   	mddev->sysfs_level = sysfs_get_dirent_safe(mddev->kobj.sd, "level");
> +	error = add_disk(disk);
> +	if (error)
> +		goto out_put_disk;
>   	mutex_unlock(&disks_mutex);
>   	return mddev;
>   
> 

syztest

[Arnaud Lecomte]

#syz test

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5978,10 +5978,6 @@ struct mddev *md_alloc(dev_t dev, char *name)
 
 	disk->events |= DISK_EVENT_MEDIA_CHANGE;
 	mddev->gendisk = disk;
-	error = add_disk(disk);
-	if (error)
-		goto out_put_disk;
-
 	kobject_init(&mddev->kobj, &md_ktype);
 	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
 	if (error) {
@@ -5999,6 +5995,9 @@ struct mddev *md_alloc(dev_t dev, char *name)
 	kobject_uevent(&mddev->kobj, KOBJ_ADD);
 	mddev->sysfs_state = sysfs_get_dirent_safe(mddev->kobj.sd, "array_state");
 	mddev->sysfs_level = sysfs_get_dirent_safe(mddev->kobj.sd, "level");
+	error = add_disk(disk);
+	if (error)
+		goto out_put_disk;
 	mutex_unlock(&disks_mutex);
 	return mddev;
 
-- 
2.43.0

syztest

[Arnaud Lecomte]

#syz test

--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -230,7 +230,7 @@ static long __bpf_get_stackid(struct bpf_map *map,
 	struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
 	struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
 	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
-	u32 hash, id, trace_nr, trace_len, i;
+	u32 hash, id, trace_nr, trace_len, i, max_depth;
 	bool user = flags & BPF_F_USER_STACK;
 	u64 *ips;
 	bool hash_matches;
@@ -241,6 +241,19 @@ static long __bpf_get_stackid(struct bpf_map *map,
 
 	trace_nr = trace->nr - skip;
 	trace_len = trace_nr * sizeof(u64);
+
+	/* Clamp the trace to max allowed depth */
+	if (stack_map_use_build_id(map))
+		max_depth = smap->map.value_size / sizeof(struct bpf_stack_build_id);
+	else
+		max_depth = smap->map.value_size / sizeof(u64);
+
+	if (trace_nr > max_depth)
+		trace_nr = max_depth;
+
+ 	ips = trace->ip + skip;
+
+
 	ips = trace->ip + skip;
 	hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
 	id = hash & (smap->n_buckets - 1);
-- 

syztest

[Arnaud Lecomte]

#syz test

--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -124,6 +124,12 @@ int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len)
 		data_rec_off += 2;
 	} while (data_rec_off < idx_rec_off);
 
+	if (end_off < data_off) {
+		hfs_dbg(BNODE_MOD, "corrupted node: end_off %u < data_off %u\n", end_off, data_off);
+		if (new_node)
+			hfs_bnode_put(new_node);
+		return -EIO;
+	}
 	/* move data away */
 	hfs_bnode_move(node, data_off + size, data_off,
 		       end_off - data_off);
-- 
2.43.0

syztest

[Arnaud Lecomte]

#syz test

--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -814,6 +814,10 @@ static int mcp2221_raw_event(struct hid_device *hdev,
 			}
 			if (data[2] == MCP2221_I2C_READ_COMPL ||
 			    data[2] == MCP2221_I2C_READ_PARTIAL) {
+				if (!mcp->rxbuf || mcp->rxbuf_idx < 0 || data[3] > 60) {
+					mcp->status = -EINVAL;
+					break;
+				}	
 				buf = mcp->rxbuf;
 				memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]);
 				mcp->rxbuf_idx = mcp->rxbuf_idx + data[3];
-- 

syztest

[Arnaud Lecomte]

#syz test

--- a/drivers/comedi/comedi_fops.c
+++ b/drivers/comedi/comedi_fops.c
@@ -1636,7 +1636,7 @@ static int do_insn_ioctl(struct comedi_device *dev,
 		n_data = MAX_SAMPLES;
 	}
 
-	data = kmalloc_array(n_data, sizeof(unsigned int), GFP_KERNEL);
+	data = kcalloc(n_data, sizeof(unsigned int), GFP_KERNEL);
 	if (!data) {
 		ret = -ENOMEM;
 		goto error;
-- 

syztest

[Arnaud Lecomte]

#syz test

--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -249,7 +249,11 @@ static unsigned int mon_copy_to_buff(const struct mon_reader_bin *this,
 		 * Copy data and advance pointers.
 		 */
 		buf = this->b_vec[off / CHUNK_SIZE].ptr + off % CHUNK_SIZE;
-		memcpy(buf, from, step_len);
+
+		if (copy_from_kernel_nofault(buf, from, step_len)) {
+			pr_warn("Failed to copy URB transfer buffer content into mon bin.");
+			return -EFAULT;
+		}
 		if ((off += step_len) >= this->b_size) off = 0;
 		from += step_len;
 		length -= step_len;
@@ -413,11 +417,13 @@ static unsigned int mon_bin_get_data(const struct mon_reader_bin *rp,
 
 	*flag = 0;
 	if (urb->num_sgs == 0) {
-		if (urb->transfer_buffer == NULL) {
+		if (
+			urb->transfer_buffer == NULL ||
+			mon_copy_to_buff(rp, offset, urb->transfer_buffer, length) < 0
+		) {
 			*flag = 'Z';
 			return length;
 		}
-		mon_copy_to_buff(rp, offset, urb->transfer_buffer, length);
 		length = 0;
 
 	} else {
@@ -434,6 +440,10 @@ static unsigned int mon_bin_get_data(const struct mon_reader_bin *rp,
 			this_len = min_t(unsigned int, sg->length, length);
 			offset = mon_copy_to_buff(rp, offset, sg_virt(sg),
 					this_len);
+			if (offset < 0) {
+				*flag = 'Z';
+				return length;
+			}
 			length -= this_len;
 		}
 		if (i == 0)

Re: syztest

[Kent Overstreet]

On Mon, Apr 28, 2025 at 06:09:03PM +0200, Arnaud Lecomte wrote:
> #syz test

Don't rely on syzbot for testing, you really need to be running the
tests yourself and looking at all the output.

It's not enough to know that we're not crashing anymore, we want the
filesystem to repair and mount successfully.

> --- a/fs/bcachefs/fsck.c
> +++ b/fs/bcachefs/fsck.c
> @@ -976,7 +976,24 @@ int bch2_fsck_update_backpointers(struct btree_trans *trans,
>  	int ret = 0;
>  
>  	if (d->v.d_type == DT_SUBVOL) {
> -		BUG();
> +		struct bch_subvolume subvol;
> +
> +		ret = bch2_subvolume_get(trans, le32_to_cpu(d->v.d_child_subvol),
> +					     false, &subvol);
> +		if (ret && !bch2_err_matches(ret, ENOENT))
> +			goto err;
> +
> +		ret = get_visible_inodes(trans, &target, s, le64_to_cpu(subvol.inode));
> +		if (ret)
> +			goto err;
> +
> +		if (target.inodes.nr) {
> +			target.inodes.data[0].inode.bi_dir_offset = d->k.p.offset;
> +			ret = __bch2_fsck_write_inode(trans, &target.inodes.data[0].inode);
> +			if (ret)
> +				goto err;
> +		}
> +
>  	} else {
>  		ret = get_visible_inodes(trans, &target, s, le64_to_cpu(d->v.d_inum));
>  		if (ret)
> -- 
> 2.43.0

syztest

[Arnaud Lecomte]

#syz test

--- a/fs/bcachefs/fsck.c
+++ b/fs/bcachefs/fsck.c
@@ -976,7 +976,24 @@ int bch2_fsck_update_backpointers(struct btree_trans *trans,
 	int ret = 0;
 
 	if (d->v.d_type == DT_SUBVOL) {
-		BUG();
+		struct bch_subvolume subvol;
+
+		ret = bch2_subvolume_get(trans, le32_to_cpu(d->v.d_child_subvol),
+					     false, &subvol);
+		if (ret && !bch2_err_matches(ret, ENOENT))
+			goto err;
+
+		ret = get_visible_inodes(trans, &target, s, le64_to_cpu(subvol.inode));
+		if (ret)
+			goto err;
+
+		if (target.inodes.nr) {
+			target.inodes.data[0].inode.bi_dir_offset = d->k.p.offset;
+			ret = __bch2_fsck_write_inode(trans, &target.inodes.data[0].inode);
+			if (ret)
+				goto err;
+		}
+
 	} else {
 		ret = get_visible_inodes(trans, &target, s, le64_to_cpu(d->v.d_inum));
 		if (ret)
-- 
2.43.0

syztest

[Arnaud Lecomte]

#syz test

--- a/block/bio.c
+++ b/block/bio.c
@@ -691,6 +691,9 @@ static void bio_truncate(struct bio *bio, unsigned new_size)
  */
 void guard_bio_eod(struct bio *bio)
 {
+	if (unlikely(!bio->bi_bdev))
+		return;
+
 	sector_t maxsector = bdev_nr_sectors(bio->bi_bdev);
 
 	if (!maxsector)
-- 
2.43.0

syztest

[Arnaud Lecomte]

#syz test

--- a/block/bio.c
+++ b/block/bio.c
@@ -691,6 +691,9 @@ static void bio_truncate(struct bio *bio, unsigned new_size)
  */
 void guard_bio_eod(struct bio *bio)
 {
+	if (unlikely(!bio->bi_bdev)
+		return;
+
 	sector_t maxsector = bdev_nr_sectors(bio->bi_bdev);
 
 	if (!maxsector)
-- 
2.43.0

Re: syztest

[syzbot]

> #syz test

This crash does not have a reproducer. I cannot test it.

>
> --- a/fs/xfs/libxfs/xfs_ialloc.c
> +++ b/fs/xfs/libxfs/xfs_ialloc.c
> @@ -1182,6 +1182,8 @@ xfs_dialloc_ag_inobt(
>                         if (error)
>                                 goto error1;
>                 } else {
> +                       pag->pagl_leftrec = NULLAGINO;
> +                       pag->pagl_rightrec = NULLAGINO;
>                         /* search left with tcur, back up 1 record */
>                         error = xfs_ialloc_next_rec(tcur, &trec, &doneleft, 1);
>                         if (error)
>

syztest

[Arnaud Lecomte]

#syz test

--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1182,6 +1182,8 @@ xfs_dialloc_ag_inobt(
                        if (error)
                                goto error1;
                } else {
+                       pag->pagl_leftrec = NULLAGINO;
+                       pag->pagl_rightrec = NULLAGINO;
                        /* search left with tcur, back up 1 record */
                        error = xfs_ialloc_next_rec(tcur, &trec, &doneleft, 1);
                        if (error)

syztest

[Arnaud Lecomte]

#syz test

--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1385,6 +1385,12 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
            (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth;
        ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));
 
+       if (ti >= le32_to_cpu(dcp->nleafs)) {
+               jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page: ti out of bounds\n");
+               release_metapage(mp);
+               return -EIO;
+       }
+
        /* dmap control page trees fan-out by 4 and a single allocation
         * group may be described by 1 or 2 subtrees within the ag level
         * dmap control page, depending upon the ag size. examine the ag's