blob: e30c0c50de2054679c87c9d96f4a88a075d6ba54 [file] [log] [blame]
From 83577bc7531c49929ef2447c487524257f77a39c Mon Sep 17 00:00:00 2001
From: Ursula Braun <>
Date: Wed, 23 Oct 2019 15:44:05 +0200
Subject: [PATCH] net/smc: fix closing of fallback SMC sockets
commit f536dffc0b79738c3104af999318279dccbaa261 upstream.
For SMC sockets forced to fallback to TCP, the file is propagated
from the outer SMC to the internal TCP socket. When closing the SMC
socket, the internal TCP socket file pointer must be restored to the
original NULL value, otherwise memory leaks may show up (found with
The internal TCP socket is released in smc_clcsock_release(), which
calls __sock_release() function in net/socket.c. This calls the
needed iput(SOCK_INODE(sock)) only, if the file pointer has been reset
to the original NULL-value.
Fixes: 07603b230895 ("net/smc: propagate file from SMC to TCP socket")
Signed-off-by: Ursula Braun <>
Signed-off-by: Karsten Graul <>
Signed-off-by: David S. Miller <>
Signed-off-by: Paul Gortmaker <>
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index a3cc879d2589..6fb3ad8b4bdc 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -123,6 +123,12 @@ struct proto smc_proto6 = {
+static void smc_restore_fallback_changes(struct smc_sock *smc)
+ smc->clcsock->file->private_data = smc->sk.sk_socket;
+ smc->clcsock->file = NULL;
static int smc_release(struct socket *sock)
struct sock *sk = sock->sk;
@@ -160,6 +166,7 @@ static int smc_release(struct socket *sock)
sk->sk_state = SMC_CLOSED;
+ smc_restore_fallback_changes(smc);