Re: [PATCH v1 net] smc: Fix various oops due to inet_sock type confusion.

["D. Wythe" <alibuda@linux.alibaba.com >]

On Fri, Jul 11, 2025 at 06:07:52AM +0000, Kuniyuki Iwashima wrote:
> syzbot reported weird splats [0][1] in cipso_v4_sock_setattr() while
> freeing inet_sk(sk)->inet_opt.
> 
> The address was freed multiple times even though it was read-only memory.
> 
> cipso_v4_sock_setattr() did nothing wrong, and the root cause was type
> confusion.
> 
> The cited commit made it possible to create smc_sock as an INET socket.
> 
> The issue is that struct smc_sock does not have struct inet_sock as the
> first member but hijacks AF_INET and AF_INET6 sk_family, which confuses
> various places.
> 
> In this case, inet_sock.inet_opt was actually smc_sock.clcsk_data_ready(),
> which is an address of a function in the text segment.
> 
>   $ pahole -C inet_sock vmlinux
>   struct inet_sock {
>   ...
>           struct ip_options_rcu *    inet_opt;             /*   784     8 */
> 
>   $ pahole -C smc_sock vmlinux
>   struct smc_sock {
>   ...
>           void                       (*clcsk_data_ready)(struct sock *); /*   784     8 */
> 
> 
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index 3760131f14845..1882bab8e00e7 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -30,6 +30,10 @@
>  #include <linux/splice.h>
>  
>  #include <net/sock.h>
> +#include <net/inet_common.h>
> +#if IS_ENABLED(CONFIG_IPV6)
> +#include <net/ipv6.h>
> +#endif
>  #include <net/tcp.h>
>  #include <net/smc.h>
>  #include <asm/ioctls.h>
> @@ -360,6 +364,16 @@ static void smc_destruct(struct sock *sk)
>  		return;
>  	if (!sock_flag(sk, SOCK_DEAD))
>  		return;
> +	switch (sk->sk_family) {
> +	case AF_INET:
> +		inet_sock_destruct(sk);
> +		break;
> +#if IS_ENABLED(CONFIG_IPV6)
> +	case AF_INET6:
> +		inet6_sock_destruct(sk);
> +		break;
> +#endif
> +	}
>  }
>  
>  static struct lock_class_key smc_key;
> diff --git a/net/smc/smc.h b/net/smc/smc.h
> index 78ae10d06ed2e..2c90849637398 100644
> --- a/net/smc/smc.h
> +++ b/net/smc/smc.h
> @@ -283,10 +283,10 @@ struct smc_connection {
>  };
>  
>  struct smc_sock {				/* smc sock container */
> -	struct sock		sk;
> -#if IS_ENABLED(CONFIG_IPV6)
> -	struct ipv6_pinfo	*pinet6;
> -#endif
> +	union {
> +		struct sock		sk;
> +		struct inet_sock	icsk_inet;
> +	};
>  	struct socket		*clcsock;	/* internal tcp socket */
>  	void			(*clcsk_state_change)(struct sock *sk);
>  						/* original stat_change fct. */
> -- 

LGTM. This is what we should have resolved a long time ago. Thank
you for your report and repair!

Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>

> 2.50.0.727.gbf7dc18ff4-goog