summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorUrsula Braun <ubraun@linux.ibm.com>2019-11-12 16:03:41 +0100
committerDavid S. Miller <davem@davemloft.net>2019-11-12 12:15:29 -0800
commit6d6dd528d5af05dc2d0c773951ed68d630a0c3f1 (patch)
tree033e0605bed205b839924f045c4a7c552fc08733
parent1d4639567d970de087a893521f7f50a32740b595 (diff)
downloadlinux-6d6dd528d5af05dc2d0c773951ed68d630a0c3f1.tar.bz2
net/smc: fix refcount non-blocking connect() -part 2
If an SMC socket is immediately terminated after a non-blocking connect() has been called, a memory leak is possible. Due to the sock_hold move in commit 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()") an extra sock_put() is needed in smc_connect_work(), if the internal TCP socket is aborted and cancels the sk_stream_wait_connect() of the connect worker. Reported-by: syzbot+4b73ad6fc767e576e275@syzkaller.appspotmail.com Fixes: 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()") Signed-off-by: Ursula Braun <ubraun@linux.ibm.com> Signed-off-by: Karsten Graul <kgraul@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/smc/af_smc.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 47946f489fd4..8edf1619f0e4 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -796,6 +796,7 @@ static void smc_connect_work(struct work_struct *work)
smc->sk.sk_err = EPIPE;
else if (signal_pending(current))
smc->sk.sk_err = -sock_intr_errno(timeo);
+ sock_put(&smc->sk); /* passive closing */
goto out;
}