Re: [syzbot] [smc?] general protection fault in smc_diag_dump_proto

Re: [syzbot] [smc?] general protection fault in smc_diag_dump_proto

[syzbot]

syzbot suspects this issue was fixed by commit:

commit d324a2ca3f8efd57f5839aa2690554a5cbb3586f
Author: Alexandra Winter <wintera@linux.ibm.com>
Date:   Thu Sep 18 11:04:50 2025 +0000

    dibs: Register smc as dibs_client

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16d64eb4580000
start commit:   dbb9a7ef3478 net: fjes: use ethtool string helpers
git tree:       net-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=a9d1c42858837b59
dashboard link: https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178f0d5f980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10906b40580000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: dibs: Register smc as dibs_client

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [smc?] general protection fault in smc_diag_dump_proto

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+f69bfae0a4eb29976e44@syzkaller.appspotmail.com
Tested-by: syzbot+f69bfae0a4eb29976e44@syzkaller.appspotmail.com

Tested on:

commit:         8f7aa3d3 Merge tag 'net-next-6.19' of git://git.kernel..
git tree:       net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10841d92580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4de27aef5cfef7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13eee77c580000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [smc?] general protection fault in smc_diag_dump_proto

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+f69bfae0a4eb29976e44@syzkaller.appspotmail.com
Tested-by: syzbot+f69bfae0a4eb29976e44@syzkaller.appspotmail.com

Tested on:

commit:         ffff5c8f net: phy: realtek: fix rtl8221b-vm-cg name
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13789d92580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=792b6ef3f55ddcc1
dashboard link: https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13e0b51a580000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [smc?] general protection fault in smc_diag_dump_proto

[Alexandra Winter]

On 07.12.25 05:29, syzbot wrote:
> syzbot suspects this issue was fixed by commit:
> 
> commit d324a2ca3f8efd57f5839aa2690554a5cbb3586f
> Author: Alexandra Winter <wintera@linux.ibm.com>
> Date:   Thu Sep 18 11:04:50 2025 +0000
> 
>     dibs: Register smc as dibs_client
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16d64eb4580000
> start commit:   dbb9a7ef3478 net: fjes: use ethtool string helpers
> git tree:       net-next
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a9d1c42858837b59
> dashboard link: https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178f0d5f980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10906b40580000
> 
> If the result looks correct, please mark the issue as fixed by replying with:
> 
> #syz fix: dibs: Register smc as dibs_client
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection


Unfortunately, I don't think
d324a2ca3f8e ("dibs: Register smc as dibs_client")
has fixed this issue.

Iiuc https://syzkaller.appspot.com/bug?extid=f69bfae0a4eb29976e44 shows an occurrence on
2025/10/17 13:18 	net-next 	7e0d4c111369
that code level already contains the bisected commit 7e0d4c111369.


Looking at net/smc/af_smc.c:smc_init()
I think the bisected patch has changed the timing of smc_ism_init() which may have led to the bisect result.

I think the issue may stem from the order of calls in smc_init().
Especially smc_nl_init(), proto_register(&smc_proto, 1), proto_register(&smc_proto6, 1), sock_register(&smc_sock_family_ops)
are all being called before:	
	INIT_HLIST_HEAD(&smc_v4_hashinfo.ht);
	INIT_HLIST_HEAD(&smc_v6_hashinfo.ht);

I think this can lead to the described "KASAN: null-ptr-deref", when calling smc_diag_handler() while the module is still being initialized.
I tried to reproduce such a race by calling smc_pnet and 'modprobe -r smc_diag smc'. But I did not hit a KASAN warning with that setting.
I'll send a patch nevertheless.