Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free. Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 8de4f665d0febfb92803dece377791a563fc7041affectedd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 8145b432136285e01091815b48ceb2dae261f262affectedd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 1951bffbc6493ec34cff3956b29d4bc6606904a6affectedd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 647b19e5cc145a2f1f685ae8ff3805a17356888caffectedd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 472e9d7c0d5b03be3ff91ff941f57da822b031bcaffectedd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bbaffectedd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < ce5aa8084329351086894aa34d77e40301d5bd3daffectedd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 9d160b35cc34a2ba8229d07651468a7848325135affected
Linux Linux
Default version status: affected
4.18affected0 to < 4.18unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041 ↗
- https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262 ↗
- https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6 ↗
- https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c ↗
- https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc ↗
- https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb ↗
- https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d ↗
- https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135 ↗