Re: [PATCH net v1] net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()

Jiayuan Chen
2026-03-07T04:36:56Z

March 7, 2026 at 11:56, "Eric Dumazet" <edumazet@google.com mailto:edumazet@google.com?to=%22Eric%20Dumazet%22%20%3Cedumazet%40google.com%3E > wrote:

>
> On Sat, Mar 7, 2026 at 4:22 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
[...]
> > diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> > index d0119afcc6a1..21218b9b0f9a 100644
> > --- a/net/smc/af_smc.c
> > +++ b/net/smc/af_smc.c
> > @@ -131,7 +131,14 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
> > struct smc_sock *smc;
> > struct sock *child;
> >
> > + read_lock_bh(&((struct sock *)sk)->sk_callback_lock);
> >
> This will not survive a SYN flood attack.
>
> Please use RCU instead.
>
> >
> > smc = smc_clcsock_user_data(sk);
> > + if (!smc) {
> > + read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
> > + return NULL;
> > + }
> > + sock_hold(&smc->sk);
> >
> If you must take a refcount, use
>
> if (!refcount_inc_not_zero(&smc->sk->sk_refcnt)) {
> rcu_read_unlock();
> return NULL;
> }

Thanks for the review.

Will try rcu_read_lock() + refcount_inc_not_zero()
and set SOCK_RCU_FREE on the listen socket.