| From 0bb43d6b565ecd2e33df7c674c305d95b482989f Mon Sep 17 00:00:00 2001 |
| From: Ursula Braun <ubraun@linux.ibm.com> |
| Date: Tue, 12 Nov 2019 16:03:41 +0100 |
| Subject: [PATCH] net/smc: fix refcount non-blocking connect() -part 2 |
| |
| commit 6d6dd528d5af05dc2d0c773951ed68d630a0c3f1 upstream. |
| |
| If an SMC socket is immediately terminated after a non-blocking connect() |
| has been called, a memory leak is possible. |
| Due to the sock_hold move in |
| commit 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()") |
| an extra sock_put() is needed in smc_connect_work(), if the internal |
| TCP socket is aborted and cancels the sk_stream_wait_connect() of the |
| connect worker. |
| |
| Reported-by: syzbot+4b73ad6fc767e576e275@syzkaller.appspotmail.com |
| Fixes: 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()") |
| Signed-off-by: Ursula Braun <ubraun@linux.ibm.com> |
| Signed-off-by: Karsten Graul <kgraul@linux.ibm.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c |
| index 7c4d59524c58..e04414f84a87 100644 |
| --- a/net/smc/af_smc.c |
| +++ b/net/smc/af_smc.c |
| @@ -786,6 +786,7 @@ static void smc_connect_work(struct work_struct *work) |
| smc->sk.sk_err = EPIPE; |
| else if (signal_pending(current)) |
| smc->sk.sk_err = -sock_intr_errno(timeo); |
| + sock_put(&smc->sk); /* passive closing */ |
| goto out; |
| } |
| |
| -- |
| 2.7.4 |
| |
