[PATCH net] net/smc: Fix sock leak when release after smc_shutdown()

[PATCH net] net/smc: Fix sock leak when release after smc_shutdown()

[Tony Lu]

Since commit e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown
and fallback"), for a fallback connection, __smc_release() does not call
sock_put() if its state is already SMC_CLOSED.

When calling smc_shutdown() after falling back, its state is set to
SMC_CLOSED but does not call sock_put(), so this patch calls it.

Reported-and-tested-by: syzbot+6e29a053eb165bd50de5@syzkaller.appspotmail.com
Fixes: e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown and fallback")
Signed-off-by: Tony Lu <tonylu@linux.alibaba.com>
---
 net/smc/af_smc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index f0d118e9f155..f842425da6ec 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -2664,8 +2664,10 @@ static int smc_shutdown(struct socket *sock, int how)
 	if (smc->use_fallback) {
 		rc = kernel_sock_shutdown(smc->clcsock, how);
 		sk->sk_shutdown = smc->clcsock->sk->sk_shutdown;
-		if (sk->sk_shutdown == SHUTDOWN_MASK)
+		if (sk->sk_shutdown == SHUTDOWN_MASK) {
 			sk->sk_state = SMC_CLOSED;
+			sock_put(sk);
+		}
 		goto out;
 	}
 	switch (how) {
-- 
2.32.0.3.g01195cf9f

Re: [PATCH net] net/smc: Fix sock leak when release after smc_shutdown()

[Karsten Graul]

On 14/04/2022 09:51, Tony Lu wrote:
> Since commit e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown
> and fallback"), for a fallback connection, __smc_release() does not call
> sock_put() if its state is already SMC_CLOSED.
> 
> When calling smc_shutdown() after falling back, its state is set to
> SMC_CLOSED but does not call sock_put(), so this patch calls it.
> 
> Reported-and-tested-by: syzbot+6e29a053eb165bd50de5@syzkaller.appspotmail.com
> Fixes: e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown and fallback")
> Signed-off-by: Tony Lu <tonylu@linux.alibaba.com>
> ---

Thank you.

Acked-by: Karsten Graul <kgraul@linux.ibm.com>

Re: [PATCH net] net/smc: Fix sock leak when release after smc_shutdown()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Thu, 14 Apr 2022 15:51:03 +0800 you wrote:
> Since commit e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown
> and fallback"), for a fallback connection, __smc_release() does not call
> sock_put() if its state is already SMC_CLOSED.
> 
> When calling smc_shutdown() after falling back, its state is set to
> SMC_CLOSED but does not call sock_put(), so this patch calls it.
> 
> [...]

Here is the summary with links:
  - [net] net/smc: Fix sock leak when release after smc_shutdown()
    https://git.kernel.org/netdev/net/c/1a74e9932374

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html