Re: syztest

Paolo Abeni
2025-06-30T06:51:41Z

On 6/29/25 3:29 PM, Arnaud Lecomte wrote:
> #syz test
>
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -123,11 +123,14 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
> struct request_sock *req_unhash,
> bool *own_req)
> {
> + read_lock_bh(&((struct sock *)sk)->sk_callback_lock);
> struct smc_sock *smc;
> struct sock *child;
> -
> smc = smc_clcsock_user_data(sk);
>
> + if (!smc)
> + goto drop;
> +
> if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
> sk->sk_max_ack_backlog)
> goto drop;
> @@ -148,9 +151,11 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
> if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
> inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
> }
> + read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
> return child;
>
> drop:
> + read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
> dst_release(dst);
> tcp_listendrop(sk);
> return NULL;
> @@ -2613,7 +2618,7 @@ int smc_listen(struct socket *sock, int backlog)
> int rc;
>
> smc = smc_sk(sk);
> - lock_sock(sk);
> + lock_sock(sock->sk);
>
> rc = -EINVAL;
> if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) ||

Please stop cc-ing netdev and other kernel ML with this tests. You
should keep just the syzkaller related MLs and a very restricted list of
individuals (i.e. no maintainers).

Thanks,

Paolo