| Message ID | 20220414075102.84366-1-tonylu@linux.alibaba.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1a74e99323746353bba11562a2f2d0aa8102f402 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net/smc: Fix sock leak when release after smc_shutdown() | expand |
On 14/04/2022 09:51, Tony Lu wrote: > Since commit e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown > and fallback"), for a fallback connection, __smc_release() does not call > sock_put() if its state is already SMC_CLOSED. > > When calling smc_shutdown() after falling back, its state is set to > SMC_CLOSED but does not call sock_put(), so this patch calls it. > > Reported-and-tested-by: syzbot+6e29a053eb165bd50de5@syzkaller.appspotmail.com > Fixes: e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown and fallback") > Signed-off-by: Tony Lu <tonylu@linux.alibaba.com> > --- Thank you. Acked-by: Karsten Graul <kgraul@linux.ibm.com>
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Thu, 14 Apr 2022 15:51:03 +0800 you wrote: > Since commit e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown > and fallback"), for a fallback connection, __smc_release() does not call > sock_put() if its state is already SMC_CLOSED. > > When calling smc_shutdown() after falling back, its state is set to > SMC_CLOSED but does not call sock_put(), so this patch calls it. > > [...] Here is the summary with links: - [net] net/smc: Fix sock leak when release after smc_shutdown() https://git.kernel.org/netdev/net/c/1a74e9932374 You are awesome, thank you!
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index f0d118e9f155..f842425da6ec 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2664,8 +2664,10 @@ static int smc_shutdown(struct socket *sock, int how) if (smc->use_fallback) { rc = kernel_sock_shutdown(smc->clcsock, how); sk->sk_shutdown = smc->clcsock->sk->sk_shutdown; - if (sk->sk_shutdown == SHUTDOWN_MASK) + if (sk->sk_shutdown == SHUTDOWN_MASK) { sk->sk_state = SMC_CLOSED; + sock_put(sk); + } goto out; } switch (how) {
Since commit e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown and fallback"), for a fallback connection, __smc_release() does not call sock_put() if its state is already SMC_CLOSED. When calling smc_shutdown() after falling back, its state is set to SMC_CLOSED but does not call sock_put(), so this patch calls it. Reported-and-tested-by: syzbot+6e29a053eb165bd50de5@syzkaller.appspotmail.com Fixes: e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown and fallback") Signed-off-by: Tony Lu <tonylu@linux.alibaba.com> --- net/smc/af_smc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)