CVE-2024-35934

In the Linux kernel, the following vulnerability has been resolved:

net/smc: reduce rtnl pressure in smcpnetcreatepnetidslist()

Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1]

This patch returns early from smcpnetnet_init() if there is no netdevice yet.

I am not even sure why smcpnetcreatepnetidslist() even exists, because smcpnetnetdevevent() is also calling smcpnetaddbasepnetid() when handling NETDEVUP event.

[1] extract of typical syzbot reports

2 locks held by syz-executor.3/12252: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878