linux-stable/net/smc
Cong Wang bb101fb44c smc: disallow TCP_ULP in smc_setsockopt()
[ Upstream commit 8621436671 ]

syzbot is able to setup kTLS on an SMC socket which coincidentally
uses sk_user_data too. Later, kTLS treats it as psock so triggers a
refcnt warning. The root cause is that smc_setsockopt() simply calls
TCP setsockopt() which includes TCP_ULP. I do not think it makes
sense to setup kTLS on top of SMC sockets, so we should just disallow
this setup.

It is hard to find a commit to blame, but we can apply this patch
since the beginning of TCP_ULP.

Reported-and-tested-by: syzbot+b54a1ce86ba4a623b7f0@syzkaller.appspotmail.com
Fixes: 734942cc4e ("tcp: ULP infrastructure")
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-22 10:59:44 +02:00
..
af_smc.c smc: disallow TCP_ULP in smc_setsockopt() 2021-05-22 10:59:44 +02:00
Kconfig
Makefile net/smc: add base infrastructure for SMC-D and ISM 2018-06-30 20:42:25 +09:00
smc.h net/smc: fix smc_poll in SMC_INIT state 2019-03-19 13:12:41 +01:00
smc_cdc.c net/smc: fix byte_order for rx_curs_confirmed 2019-12-05 09:21:09 +01:00
smc_cdc.h net/smc: fix byte_order for rx_curs_confirmed 2019-12-05 09:21:09 +01:00
smc_clc.c net/smc: no peer ID in CLC decline for SMCD 2020-03-05 16:42:20 +01:00
smc_clc.h net/smc: provide fallback reason code 2018-07-25 22:25:53 -07:00
smc_close.c net/smc: enable fallback for connection abort in state INIT 2018-09-18 20:11:43 -07:00
smc_close.h net/smc: replace sock_put worker by socket refcounting 2018-01-26 10:41:56 -05:00
smc_core.c net/smc: fix valid DMBE buffer sizes 2020-10-29 09:54:55 +01:00
smc_core.h net/smc: improve delete link processing 2018-07-25 22:25:53 -07:00
smc_diag.c net/smc: Prevent kernel-infoleak in __smc_diag_dump() 2020-09-03 11:24:17 +02:00
smc_ib.c net/smc: cancel event worker during device removal 2020-03-18 07:14:25 +01:00
smc_ib.h net/smc: use correct vlan gid of RoCE device 2018-07-25 22:25:53 -07:00
smc_ism.c net/smc: send response to test link signal 2018-08-10 14:38:43 -07:00
smc_ism.h net/smc: add base infrastructure for SMC-D and ISM 2018-06-30 20:42:25 +09:00
smc_llc.c net/smc: improve delete link processing 2018-07-25 22:25:53 -07:00
smc_llc.h net/smc: improve delete link processing 2018-07-25 22:25:53 -07:00
smc_pnet.c smc: generic netlink family should be __ro_after_init 2018-09-20 07:49:55 -07:00
smc_pnet.h net/smc: use correct vlan gid of RoCE device 2018-07-25 22:25:53 -07:00
smc_rx.c net/smc: receive pending data after RCV_SHUTDOWN 2020-01-27 14:51:18 +01:00
smc_rx.h smc: add support for splice() 2018-05-04 11:45:06 -04:00
smc_tx.c net/smc: do not wait under send_lock 2019-12-17 20:35:33 +01:00
smc_tx.h net/smc: eliminate cursor read and write calls 2018-07-23 10:57:14 -07:00
smc_wr.c net/smc: use after free fix in smc_wr_tx_put_slot() 2019-12-13 08:51:34 +01:00
smc_wr.h net/smc: Simplify ib_post_(send|recv|srq_recv)() calls 2018-07-24 16:06:37 -06:00