[PATCH net v2 0/2] net/smc: fix use-after-free in smc_rx_pipe_buf_release()

[Hidayath Khan <hidayath@linux.ibm.com>]

smc_rx_pipe_buf_release() tests sk_state before taking the socket lock
and then dereferences conn->rmb_desc and conn->lgr. A concurrent close
runs smc_conn_free() in between, which releases those structures. On the
is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this
is a use-after-free.

Patch 2/2 fixes this by taking the socket lock first and testing
conn->freed instead. smc_conn_free() sets that flag before releasing
anything, under the same lock, so the two paths exclude each other.

Patch 1/2 is a prerequisite. conn->freed shares a byte with killed and
out_of_sync as single-bit bitfields. out_of_sync is written from the
receive tasklet without the socket lock, so a concurrent store to freed
from process context can be lost in the read-modify-write. Patch 1/2
gives each flag its own byte so stores do not interfere.

Hidayath Khan (2):
  net/smc: stop killed, freed and out_of_sync sharing a byte
  net/smc: fix use-after-free in smc_rx_pipe_buf_release()

 net/smc/smc.h    |  6 +++---
 net/smc/smc_rx.c | 11 +++++------
 2 files changed, 8 insertions(+), 9 deletions(-)

---
v2:
- Patch 1/2 is new. It is a prerequisite for 2/2.
- Patch 2/2 replaces the conn->rmb_desc = NULL approach from v1 with a
  conn->freed check. The NULL store exposed smc_cdc_msg_recv_action()
  and the sock_diag dump to NULL dereferences on paths that do not take
  the socket lock.

-- 
2.52.0