[PATCH net] net/smc: serialize clcsock teardown in smc_accept_dequeue

[Mahanta Jambigi <mjambigi@linux.ibm.com>]

smc_accept_dequeue() open-codes clcsock teardown for SMC_CLOSED child sockets
without taking clcsock_release_lock:

  new_sk->sk_prot->unhash(new_sk);
  if (isk->clcsock) {
      sock_release(isk->clcsock);
      isk->clcsock = NULL;
  }

This bypasses the clcsock_release_lock discipline used elsewhere in SMC clcsock
lifetime handling. In particular, other paths serialize clcsock access and
updates with clcsock_release_lock, but this local teardown path does not.

Fix it by taking clcsock_release_lock around the local teardown and by storing
NULL before sock_release(), matching the established ordering used by other
clcsock teardown paths.

Fixes: 127f49705823 ("net/smc: release clcsock from tcp_listen_worker")
Reviewed-by: Hidayath Khan <hidayath@linux.ibm.com>
Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
---
 net/smc/af_smc.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 00403175b740..bbf8269876ee 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1833,10 +1833,14 @@ struct sock *smc_accept_dequeue(struct sock *parent,
 		smc_accept_unlink(new_sk);
 		if (new_sk->sk_state == SMC_CLOSED) {
 			new_sk->sk_prot->unhash(new_sk);
-			if (isk->clcsock) {
-				sock_release(isk->clcsock);
-				isk->clcsock = NULL;
-			}
+			mutex_lock(&isk->clcsock_release_lock);
+			if (isk->clcsock) {
+				struct socket *clcsock = isk->clcsock;
+
+				isk->clcsock = NULL;
+				sock_release(clcsock);
+			}
+			mutex_unlock(&isk->clcsock_release_lock);
 			sock_put(new_sk); /* final */
 			continue;
 		}
-- 
2.50.1 (Apple Git-155)