In the Linux kernel, the following vulnerability has been resolved:
net/smc: reduce rtnl pressure in smcpnetcreatepnetidslist()
Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1]
This patch returns early from smcpnetnet_init() if there is no netdevice yet.
I am not even sure why smcpnetcreatepnetidslist() even exists, because smcpnetnetdevevent() is also calling smcpnetaddbasepnetid() when handling NETDEVUP event.
[1] extract of typical syzbot reports
2 locks held by syz-executor.3/12252: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 187.0,
"function_hash": "290881867645498100214324265393024885029"
},
"target": {
"file": "net/smc/smc_pnet.c",
"function": "smc_pnet_create_pnetids_list"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00af2aa93b76b1bade471ad0d0525d4d29ca5cc0",
"signature_version": "v1",
"id": "CVE-2024-35934-0a9c0464"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 187.0,
"function_hash": "290881867645498100214324265393024885029"
},
"target": {
"file": "net/smc/smc_pnet.c",
"function": "smc_pnet_create_pnetids_list"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ee3bf0caf599c14db0bf4af7aacd6206ef8a23",
"signature_version": "v1",
"id": "CVE-2024-35934-1a3219e1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 187.0,
"function_hash": "290881867645498100214324265393024885029"
},
"target": {
"file": "net/smc/smc_pnet.c",
"function": "smc_pnet_create_pnetids_list"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e920422e7104928f760fc0e12b6d65ab097a2e7",
"signature_version": "v1",
"id": "CVE-2024-35934-20a34993"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 187.0,
"function_hash": "290881867645498100214324265393024885029"
},
"target": {
"file": "net/smc/smc_pnet.c",
"function": "smc_pnet_create_pnetids_list"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9117dc783c0ab0a3866812f70e07bf2ea071ac4",
"signature_version": "v1",
"id": "CVE-2024-35934-31a6303d"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"26680726748988663096646594689730648846",
"320312117335359360296677295202459294352",
"163966053499041636165198277756408296293"
],
"threshold": 0.9
},
"target": {
"file": "net/smc/smc_pnet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00af2aa93b76b1bade471ad0d0525d4d29ca5cc0",
"signature_version": "v1",
"id": "CVE-2024-35934-4c22066b"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"26680726748988663096646594689730648846",
"320312117335359360296677295202459294352",
"163966053499041636165198277756408296293"
],
"threshold": 0.9
},
"target": {
"file": "net/smc/smc_pnet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ee3bf0caf599c14db0bf4af7aacd6206ef8a23",
"signature_version": "v1",
"id": "CVE-2024-35934-6ba7b9e0"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 187.0,
"function_hash": "290881867645498100214324265393024885029"
},
"target": {
"file": "net/smc/smc_pnet.c",
"function": "smc_pnet_create_pnetids_list"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e6bffc0388526ed10406040279a693d62b36ec",
"signature_version": "v1",
"id": "CVE-2024-35934-877cdd17"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"26680726748988663096646594689730648846",
"320312117335359360296677295202459294352",
"163966053499041636165198277756408296293"
],
"threshold": 0.9
},
"target": {
"file": "net/smc/smc_pnet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc4d1ebca11b4f194e262326bd45938e857c59d2",
"signature_version": "v1",
"id": "CVE-2024-35934-9ec933f6"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"26680726748988663096646594689730648846",
"320312117335359360296677295202459294352",
"163966053499041636165198277756408296293"
],
"threshold": 0.9
},
"target": {
"file": "net/smc/smc_pnet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9117dc783c0ab0a3866812f70e07bf2ea071ac4",
"signature_version": "v1",
"id": "CVE-2024-35934-a5bd92b9"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 187.0,
"function_hash": "290881867645498100214324265393024885029"
},
"target": {
"file": "net/smc/smc_pnet.c",
"function": "smc_pnet_create_pnetids_list"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc4d1ebca11b4f194e262326bd45938e857c59d2",
"signature_version": "v1",
"id": "CVE-2024-35934-aedef978"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"26680726748988663096646594689730648846",
"320312117335359360296677295202459294352",
"163966053499041636165198277756408296293"
],
"threshold": 0.9
},
"target": {
"file": "net/smc/smc_pnet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2e6bffc0388526ed10406040279a693d62b36ec",
"signature_version": "v1",
"id": "CVE-2024-35934-cc37a5e8"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"26680726748988663096646594689730648846",
"320312117335359360296677295202459294352",
"163966053499041636165198277756408296293"
],
"threshold": 0.9
},
"target": {
"file": "net/smc/smc_pnet.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e920422e7104928f760fc0e12b6d65ab097a2e7",
"signature_version": "v1",
"id": "CVE-2024-35934-d9be7dde"
}
]