blob: e17076e3909a30e7899e42a3d0809faf12966365 [file] [log] [blame]
From 0bb43d6b565ecd2e33df7c674c305d95b482989f Mon Sep 17 00:00:00 2001
From: Ursula Braun <>
Date: Tue, 12 Nov 2019 16:03:41 +0100
Subject: [PATCH] net/smc: fix refcount non-blocking connect() -part 2
commit 6d6dd528d5af05dc2d0c773951ed68d630a0c3f1 upstream.
If an SMC socket is immediately terminated after a non-blocking connect()
has been called, a memory leak is possible.
Due to the sock_hold move in
commit 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()")
an extra sock_put() is needed in smc_connect_work(), if the internal
TCP socket is aborted and cancels the sk_stream_wait_connect() of the
connect worker.
Fixes: 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()")
Signed-off-by: Ursula Braun <>
Signed-off-by: Karsten Graul <>
Signed-off-by: David S. Miller <>
Signed-off-by: Paul Gortmaker <>
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 7c4d59524c58..e04414f84a87 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -786,6 +786,7 @@ static void smc_connect_work(struct work_struct *work)
smc->sk.sk_err = EPIPE;
else if (signal_pending(current))
smc->sk.sk_err = -sock_intr_errno(timeo);
+ sock_put(&smc->sk); /* passive closing */
goto out;