From ded8a12a06e7f3c746295b1c863e107a1656261c Mon Sep 17 00:00:00 2001 From: Alexandra Winter Date: Thu, 21 May 2026 22:56:39 +0800 Subject: [PATCH] net/smc: Do not re-initialize smc hashtables ANBZ: #40686 commit cdc79c05cc375f68ae87b0c74fdaac1a5c93155a stable. commit 9e4389b0038781f19f97895186ed941ff8ac1678 upstream. INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(), proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht being reset even though hash entries already exist and are being used, possibly resulting in a corrupted list. Remove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in smc_init(); it is implicitly initialised to zero anyhow. Add HLIST_HEAD_INIT to the definitions for clarity. Fixes: f16a7dd5cf27 ("smc: netlink interface for SMC sockets") Suggested-by: Halil Pasic Signed-off-by: Alexandra Winter Acked-by: Halil Pasic Reviewed-by: Mahanta Jambigi Link: https://patch.msgid.link/20260521145639.10317-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Fixes: CVE-2026-64005 Assisted-by: PatchPilot Signed-off-by: D. Wythe --- net/smc/af_smc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 9d4e302e194d..08e92a8188da 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -265,10 +265,12 @@ static bool smc_hs_congested(const struct sock *sk) static struct smc_hashinfo smc_v4_hashinfo = { .lock = __RW_LOCK_UNLOCKED(smc_v4_hashinfo.lock), + .ht = HLIST_HEAD_INIT, }; static struct smc_hashinfo smc_v6_hashinfo = { .lock = __RW_LOCK_UNLOCKED(smc_v6_hashinfo.lock), + .ht = HLIST_HEAD_INIT, }; static int smc_hash_sk(struct sock *sk) @@ -4885,8 +4887,6 @@ static int __init smc_init(void) pr_err("%s: sock_register fails with %d\n", __func__, rc); goto out_proto6; } - INIT_HLIST_HEAD(&smc_v4_hashinfo.ht); - INIT_HLIST_HEAD(&smc_v6_hashinfo.ht); rc = smc_ib_register_client(); if (rc) { -- Gitee