diff options
| author | Ursula Braun <ubraun@linux.ibm.com> | 2019-08-02 10:16:38 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-08-09 17:52:32 +0200 |
| commit | ce58a3655121936ebf353db542315e3531233113 (patch) | |
| tree | 89c762ead8f0f2feffa5fdd85761719dd68c0130 | |
| parent | 51d240a144a5742977b4a421ea42b7da5bf1439c (diff) | |
| download | linux-stable-ce58a3655121936ebf353db542315e3531233113.tar.gz linux-stable-ce58a3655121936ebf353db542315e3531233113.tar.bz2 linux-stable-ce58a3655121936ebf353db542315e3531233113.zip | |
net/smc: do not schedule tx_work in SMC_CLOSED state
[ Upstream commit f9cedf1a9b1cdcfb0c52edb391d01771e43994a4 ]
The setsockopts options TCP_NODELAY and TCP_CORK may schedule the
tx worker. Make sure the socket is not yet moved into SMC_CLOSED
state (for instance by a shutdown SHUT_RDWR call).
Reported-by: syzbot+92209502e7aab127c75f@syzkaller.appspotmail.com
Reported-by: syzbot+b972214bb803a343f4fe@syzkaller.appspotmail.com
Fixes: 01d2f7e2cdd31 ("net/smc: sockopts TCP_NODELAY and TCP_CORK")
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/smc/af_smc.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 9bbab6ba2dab..26dcd02b2d0c 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1680,14 +1680,18 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, } break; case TCP_NODELAY: - if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) { + if (sk->sk_state != SMC_INIT && + sk->sk_state != SMC_LISTEN && + sk->sk_state != SMC_CLOSED) { if (val && !smc->use_fallback) mod_delayed_work(system_wq, &smc->conn.tx_work, 0); } break; case TCP_CORK: - if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) { + if (sk->sk_state != SMC_INIT && + sk->sk_state != SMC_LISTEN && + sk->sk_state != SMC_CLOSED) { if (!val && !smc->use_fallback) mod_delayed_work(system_wq, &smc->conn.tx_work, 0); |