From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85B21332EC1; Tue, 16 Jun 2026 17:35:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781631309; cv=none; b=V6xzYwJXKlKCunZg0SJk6gHGahqqp9gqx5s+XDxGQI3QJ7OP7qtSQ8AVd6+k1ewiWK/LROA1HThGGtwV+s9I1U2noKBDElbQKk/OSEAzdwNm3GiyWDniJZCPdzw+nz/HOIh4mKGfVhbHVDn4nOBBRrppU62dAkSCX4rz+SI8Qqk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781631309; c=relaxed/simple; bh=xFuWk2KJIp+YL6O0cqCYUiFzKyUgHo12/fIIRz1Sft8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ifwBR5nApgFXkJF02tfhz0+bFM9XYhEc4uBC+ufcJN2u+w2bsO7yPgpjtziZ6tAXzGNBSzpFQDx9itwX37Ohg31r/N4e+lnRCT/qF5zQGC1sHSfBknQjNtr09e+d9hpbF3mHRWqo5WnMCN6ER7X1NpWBYylcbWBIUDZLc8xfOM8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RZezc1EX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="RZezc1EX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4F0051F000E9; Tue, 16 Jun 2026 17:35:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781631308; bh=MbVmYUHWKGFhp4ZDKkjgDNY0jytBHw8JyBhWSvc7XwI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RZezc1EX8/rPD3uAgkeESvBP6uMSGoGUqaG6pPoQ1r6J5k9DiAZH7/J/u1w733fge GHBlrCnPo+vOh4wqlyePWgynvoAhkUxJZLz4Xqa3GLrkmTUS/ADKWXwa2Rd7sWsHTC HeKEZP4H0B8NiPE6zoR0b+Aw8d0rKn2kAeFhzGAw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, =?UTF-8?q?Nicol=C3=B2=20Coccia?= , Dust Li , Jakub Kicinski Subject: [PATCH 6.1 196/522] net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS Date: Tue, 16 Jun 2026 20:25:43 +0530 Message-ID: <20260616145135.265447826@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145125.307082728@linuxfoundation.org> References: <20260616145125.307082728@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nicolò Coccia commit a3fdd924d88c30b9f488636ce0e4696012cf5511 upstream. A logic flaw in __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding the socket lock indefinitely. The function __smc_setsockopt() calls copy_from_sockptr() while holding lock_sock(sk). By passing a userfaultfd-monitored memory page (or FUSE-backed memory on systems where unprivileged userfaultfd is disabled) as the optval, an attacker can halt execution during the copy operation, keeping the lock held. Combined with asynchronous tear-down operations like shutdown(), this exhausts the kernel wq (kworkers) and triggers the hung task watchdog. [ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds. [ 240.123489] Call Trace: [ 240.123501] smc_shutdown+... [ 240.123512] lock_sock_nested+... This patch moves the user-space copy outside the lock_sock() critical section to prevent the issue. Fixes: a6a6fe27bab4 ("net/smc: Dynamic control handshake limitation by socket options") Signed-off-by: Nicolò Coccia Reviewed-by: Dust Li Tested-by: Dust Li Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/smc/af_smc.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2947,18 +2947,17 @@ static int __smc_setsockopt(struct socke smc = smc_sk(sk); + /* pre-fetch user data outside the lock */ + if (optname == SMC_LIMIT_HS) { + if (optlen < sizeof(int)) + return -EINVAL; + if (copy_from_sockptr(&val, optval, sizeof(int))) + return -EFAULT; + } + lock_sock(sk); switch (optname) { case SMC_LIMIT_HS: - if (optlen < sizeof(int)) { - rc = -EINVAL; - break; - } - if (copy_from_sockptr(&val, optval, sizeof(int))) { - rc = -EFAULT; - break; - } - smc->limit_smc_hs = !!val; rc = 0; break;