Re: [syzbot] [smc?] general protection fault in smc_diag_dump_proto

[Alexandra Winter <wintera@linux.ibm.com>]

On 07.12.25 05:29, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
> 
> commit d324a2ca3f8efd57f5839aa2690554a5cbb3586f
> Author: Alexandra Winter <wintera@linux.ibm.com>
> Date:   Thu Sep 18 11:04:50 2025 +0000
> 
>     dibs: Register smc as dibs_client
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16d64eb4580000
> start commit:   dbb9a7ef3478 net: fjes: use ethtool string helpers
> git tree:       net-next
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a9d1c42858837b59
> dashboard link: https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178f0d5f980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10906b40580000
> 
> If the result looks correct, please mark the issue as fixed by replying with:
> 
> #syz fix: dibs: Register smc as dibs_client
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection


Unfortunately, I don't think
d324a2ca3f8e ("dibs: Register smc as dibs_client")
has fixed this issue.

Iiuc https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44 shows an occurrence on
2025/10/17 13:18 	net-next 	7e0d4c111369
that code level already contains the bisected commit 7e0d4c111369.


Looking at net/smc/af_smc.c:smc_init()
I think the bisected patch has changed the timing of smc_ism_init() which may have led to the bisect result.

I think the issue may stem from the order of calls in smc_init().
Especially smc_nl_init(), proto_register(&smc_proto, 1), proto_register(&smc_proto6, 1), sock_register(&smc_sock_family_ops)
are all being called before:	
	INIT_HLIST_HEAD(&smc_v4_hashinfo.ht);
	INIT_HLIST_HEAD(&smc_v6_hashinfo.ht);

I think this can lead to the described "KASAN: null-ptr-deref", when calling smc_diag_handler() while the module is still being initialized.
I tried to reproduce such a race by calling smc_pnet and 'modprobe -r smc_diag smc'. But I did not hit a KASAN warning with that setting.
I'll send a patch nevertheless.