diff options
| author | Ursula Braun <ubraun@linux.ibm.com> | 2018-07-05 16:15:30 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-07-07 20:25:13 +0900 |
| commit | e1bbdd57047454dad068dc36612dd60a57f4c58f (patch) | |
| tree | 76e741e90f29cedf93a749cb68d9695704482958 /net/smc/smc_close.c | |
| parent | 000244d3dc1f8114e38fe9ee2d9a0986404d9cbe (diff) | |
| download | linux-e1bbdd57047454dad068dc36612dd60a57f4c58f.tar.gz linux-e1bbdd57047454dad068dc36612dd60a57f4c58f.tar.bz2 linux-e1bbdd57047454dad068dc36612dd60a57f4c58f.zip | |
net/smc: reduce sock_put() for fallback sockets
smc_release() calls a sock_put() for smc fallback sockets to cover
the passive closing sock_hold() in __smc_connect() and
smc_tcp_listen_work(). This does not make sense for sockets in state
SMC_LISTEN and SMC_INIT.
An SMC socket stays in state SMC_INIT if connect fails. The sock_put
in smc_connect_abort() does not cover all failures. Move it into
smc_connect_decline_fallback().
Fixes: ee9dfbef02d18 ("net/smc: handle sockopts forcing fallback")
Reported-by: syzbot+3a0748c8f2f210c0ef9b@syzkaller.appspotmail.com
Reported-by: syzbot+9e60d2428a42049a592a@syzkaller.appspotmail.com
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/smc/smc_close.c')
| -rw-r--r-- | net/smc/smc_close.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c index fa41d9881741..ac961dfb1ea1 100644 --- a/net/smc/smc_close.c +++ b/net/smc/smc_close.c @@ -107,6 +107,8 @@ static void smc_close_active_abort(struct smc_sock *smc) } switch (sk->sk_state) { case SMC_INIT: + sk->sk_state = SMC_PEERABORTWAIT; + break; case SMC_ACTIVE: sk->sk_state = SMC_PEERABORTWAIT; release_sock(sk); |