net/smc: prevent NULL pointer dereference in txopt_get

Since smc_inet6_prot does not initialize ipv6_pinfo_offset, inet6_create()
copies an incorrect address value, sk + 0 (offset), to inet_sk(sk)->pinet6.

In addition, since inet_sk(sk)->pinet6 and smc_sk(sk)->clcsock practically
point to the same address, when smc_create_clcsk() stores the newly
created clcsock in smc_sk(sk)->clcsock, inet_sk(sk)->pinet6 is corrupted
into clcsock. This causes NULL pointer dereference and various other
memory corruptions.

To solve this problem, you need to initialize ipv6_pinfo_offset, add a
smc6_sock structure, and then add ipv6_pinfo as the second member of
the smc_sock structure.

Reported-by: syzkaller <syzkaller@googlegroups.com>
Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/smc/smc.h b/net/smc/smc.h
index 34b781e463c43a91e3722e105e0b3b5ebc63e3d6..ad77d6b6b8d3aefb09b958937111eb3263d2dd87 100644 (file)
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -284,6 +284,9 @@ struct smc_connection {
 
 struct smc_sock {                              /* smc sock container */
        struct sock             sk;
+#if IS_ENABLED(CONFIG_IPV6)
+       struct ipv6_pinfo       *pinet6;
+#endif
        struct socket           *clcsock;       /* internal tcp socket */
        void                    (*clcsk_state_change)(struct sock *sk);
                                                /* original stat_change fct. */

diff --git a/net/smc/smc_inet.c b/net/smc/smc_inet.c
index bece346dd8e9d737ab4facb32386e165357a2842..a5b2041600f95958f5d2f85a6fa4601683279dcb 100644 (file)
--- a/net/smc/smc_inet.c
+++ b/net/smc/smc_inet.c
@@ -60,6 +60,11 @@ static struct inet_protosw smc_inet_protosw = {
 };
 
 #if IS_ENABLED(CONFIG_IPV6)
+struct smc6_sock {
+       struct smc_sock         smc;
+       struct ipv6_pinfo       inet6;
+};
+
 static struct proto smc_inet6_prot = {
        .name           = "INET6_SMC",
        .owner          = THIS_MODULE,
@@ -67,9 +72,10 @@ static struct proto smc_inet6_prot = {
        .hash           = smc_hash_sk,
        .unhash         = smc_unhash_sk,
        .release_cb     = smc_release_cb,
-       .obj_size       = sizeof(struct smc_sock),
+       .obj_size       = sizeof(struct smc6_sock),
        .h.smc_hash     = &smc_v6_hashinfo,
        .slab_flags     = SLAB_TYPESAFE_BY_RCU,
+       .ipv6_pinfo_offset      = offsetof(struct smc6_sock, inet6),
 };
 
 static const struct proto_ops smc_inet6_stream_ops = {