CVE-2024-35934 Information
Description
In the Linux kernel the following vulnerability has been resolved:
net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
Many syzbot reports show extreme rtnl pressure and many of them hint that smc acquires rtnl in netns creation for no good reason [1]
This patch returns early from smc_pnet_net_init() if there is no netdevice yet.
I am not even sure why smc_pnet_create_pnetids_list() even exists because smc_pnet_netdev_event() is also calling smc_pnet_add_base_pnetid() when handling NETDEV_UP event.
[1] extract of typical syzbot reports
2 locks held by syz-executor.3/12252: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12253: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12257: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12261: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.0/12265: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.3/12268: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12271: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12274: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12280: 0: ffffffff8f369610 (pernet_ops_rwsem)++++-3:3 at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] 1: ffffffff8f375b88 (rtnl_mutex)+.+.-3:3 at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878
Reference
https://git.kernel.org/stable/c/bc4d1ebca11b4f194e262326bd45938e857c59d2 https://git.kernel.org/stable/c/b9117dc783c0ab0a3866812f70e07bf2ea071ac4 https://git.kernel.org/stable/c/d7ee3bf0caf599c14db0bf4af7aacd6206ef8a23 https://git.kernel.org/stable/c/a2e6bffc0388526ed10406040279a693d62b36ec https://git.kernel.org/stable/c/6e920422e7104928f760fc0e12b6d65ab097a2e7 https://git.kernel.org/stable/c/00af2aa93b76b1bade471ad0d0525d4d29ca5cc0
Share on: