CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
In the Linux kernel, the following vulnerability has been resolved:
net/smc: reduce rtnl pressure in smcpnetcreatepnetidslist()
Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1]
This patch returns early from smcpnetnetinit() if there is no netdevice yet.
I am not even sure why smcpnetcreatepnetidslist() even exists, because smcpnetnetdevevent() is also calling smcpnetaddbasepnetid() when handling NETDEVUP event.
[1] extract of typical syzbot reports
2 locks held by syz-executor.3/12252: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610 (pernetopsrwsem){++++}-{3:3}, at: copynetns+0x4c7/0x7b0 net/core/netnamespace.c:491 #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetcreatepnetidslist net/smc/smcpnet.c:809 [inline] #1: ffffffff8f375b88 (rtnlmutex){+.+.}-{3:3}, at: smcpnetnetinit+0x10a/0x1e0 net/smc/smcpnet.c:878
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net/smc: reduce rtnl pressure in smcpnetcreatepnetidslist()
The Linux kernel CVE team has assigned CVE-2024-35934 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051917-CVE-2024-35934-c8af@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35934?
CVE-2024-35934 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35934?
To fix CVE-2024-35934, upgrade to the affected Linux kernel versions specified in the advisory.
Which Linux kernel versions are affected by CVE-2024-35934?
CVE-2024-35934 affects specific versions including 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, and 6.12.13-1.
What components are involved in CVE-2024-35934?
CVE-2024-35934 involves the net/smc component of the Linux kernel's networking subsystem.
Is CVE-2024-35934 related to network namespace creation?
Yes, CVE-2024-35934 is associated with rtnl pressure during network namespace creation in the Linux kernel.