[PATCH net] net/smc: fix NULL pointer dereference in smc_clc_wait_msg()

[PATCH net] net/smc: fix NULL pointer dereference in smc_clc_wait_msg()

[Weiming Shi]

In smc_listen_work(), smc_clc_wait_msg() is called to wait for a CLC
PROPOSAL message before any link group has been created, so
smc->conn.lgr is still NULL at this point. smc_clc_wait_msg() also
accepts CLC DECLINE messages regardless of the expected type. When a
DECLINE with SMC_FIRST_CONTACT_MASK set in hdr.typev2 arrives, the code
unconditionally dereferences smc->conn.lgr to set sync_err, causing a
NULL pointer dereference.

KASAN reported a null-ptr-deref in smc_clc_wait_msg():

 Oops: general protection fault, 0000 [#1] SMP KASAN NOPTI
 KASAN: null-ptr-deref in range [0x0000000000000310-0x0000000000000317]
 RIP: 0010:smc_clc_wait_msg (net/smc/smc_clc.c:793)
 Call Trace:
  <TASK>
  smc_listen_work (net/smc/af_smc.c:2491)
  process_one_work (kernel/workqueue.c:3281)
  worker_thread (kernel/workqueue.c:3440)
  kthread (kernel/kthread.c:436)
  ret_from_fork (arch/x86/kernel/process.c:164)
  ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
  </TASK>
 Kernel panic - not syncing: Fatal exception

Add a NULL check for smc->conn.lgr before dereferencing it. 

Fixes: 0cfdd8f92cac ("smc: connection and link group creation")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/smc/smc_clc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index c38fc7bf0a7e..d22c9417d239 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -790,8 +790,10 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
 		smc->peer_diagnosis = ntohl(dclc->peer_diagnosis);
 		if (((struct smc_clc_msg_decline *)buf)->hdr.typev2 &
 						SMC_FIRST_CONTACT_MASK) {
-			smc->conn.lgr->sync_err = 1;
-			smc_lgr_terminate_sched(smc->conn.lgr);
+			if (smc->conn.lgr) {
+				smc->conn.lgr->sync_err = 1;
+				smc_lgr_terminate_sched(smc->conn.lgr);
+			}
 		}
 	}
 
-- 
2.43.0

Re: [PATCH net] net/smc: fix NULL pointer dereference in smc_clc_wait_msg()

[Dust Li]

On 2026-04-23 03:02:07, Weiming Shi wrote:

Hi Weiming,

Ren Wei has already send the patch to the mailist

[PATCH net 1/1] net/smc: avoid early lgr access in smc_clc_wait_msg

Best regards,
Dust

>In smc_listen_work(), smc_clc_wait_msg() is called to wait for a CLC
>PROPOSAL message before any link group has been created, so
>smc->conn.lgr is still NULL at this point. smc_clc_wait_msg() also
>accepts CLC DECLINE messages regardless of the expected type. When a
>DECLINE with SMC_FIRST_CONTACT_MASK set in hdr.typev2 arrives, the code
>unconditionally dereferences smc->conn.lgr to set sync_err, causing a
>NULL pointer dereference.
>
>KASAN reported a null-ptr-deref in smc_clc_wait_msg():
>
> Oops: general protection fault, 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000310-0x0000000000000317]
> RIP: 0010:smc_clc_wait_msg (net/smc/smc_clc.c:793)
> Call Trace:
>  <TASK>
>  smc_listen_work (net/smc/af_smc.c:2491)
>  process_one_work (kernel/workqueue.c:3281)
>  worker_thread (kernel/workqueue.c:3440)
>  kthread (kernel/kthread.c:436)
>  ret_from_fork (arch/x86/kernel/process.c:164)
>  ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
>  </TASK>
> Kernel panic - not syncing: Fatal exception
>
>Add a NULL check for smc->conn.lgr before dereferencing it. 
>
>Fixes: 0cfdd8f92cac ("smc: connection and link group creation")
>Reported-by: Xiang Mei <xmei5@asu.edu>
>Signed-off-by: Weiming Shi <bestswngs@gmail.com>
>---
> net/smc/smc_clc.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
>index c38fc7bf0a7e..d22c9417d239 100644
>--- a/net/smc/smc_clc.c
>+++ b/net/smc/smc_clc.c
>@@ -790,8 +790,10 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
> 		smc->peer_diagnosis = ntohl(dclc->peer_diagnosis);
> 		if (((struct smc_clc_msg_decline *)buf)->hdr.typev2 &
> 						SMC_FIRST_CONTACT_MASK) {
>-			smc->conn.lgr->sync_err = 1;
>-			smc_lgr_terminate_sched(smc->conn.lgr);
>+			if (smc->conn.lgr) {
>+				smc->conn.lgr->sync_err = 1;
>+				smc_lgr_terminate_sched(smc->conn.lgr);
>+			}
> 		}
> 	}
> 
>-- 
>2.43.0