Re: [PATCH net v1] net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()

[Jiayuan Chen]

March 7, 2026 at 11:56, "Eric Dumazet" <edumazet@xxxxxxxxxx mailto:edumazet@xxxxxxxxxx?to=%22Eric%20Dumazet%22%20%3Cedumazet%40google.com%3E > wrote:


> 
> On Sat, Mar 7, 2026 at 4:22 AM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
> 
[...]
> >  diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> >  index d0119afcc6a1..21218b9b0f9a 100644
> >  --- a/net/smc/af_smc.c
> >  +++ b/net/smc/af_smc.c
> >  @@ -131,7 +131,14 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
> >  struct smc_sock *smc;
> >  struct sock *child;
> > 
> >  + read_lock_bh(&((struct sock *)sk)->sk_callback_lock);
> > 
> This will not survive a SYN flood attack.
> 
> Please use RCU instead.
> 
> > 
> > smc = smc_clcsock_user_data(sk);
> >  + if (!smc) {
> >  + read_unlock_bh(&((struct sock *)sk)->sk_callback_lock);
> >  + return NULL;
> >  + }
> >  + sock_hold(&smc->sk);
> > 
> If you must take a refcount, use
> 
> if (!refcount_inc_not_zero(&smc->sk->sk_refcnt)) {
>  rcu_read_unlock();
>  return NULL;
> }

Thanks for the review.

Will try rcu_read_lock() + refcount_inc_not_zero()
and set SOCK_RCU_FREE on the listen socket.