Commit ce58a365 authored Aug 02, 2019 by Ursula Braun Committed by Greg Kroah-Hartman Aug 09, 2019

net/smc: do not schedule tx_work in SMC_CLOSED state



[ Upstream commit f9cedf1a9b1cdcfb0c52edb391d01771e43994a4 ]

The setsockopts options TCP_NODELAY and TCP_CORK may schedule the
tx worker. Make sure the socket is not yet moved into SMC_CLOSED
state (for instance by a shutdown SHUT_RDWR call).

Reported-by:  <syzbot+92209502e7aab127c75f@syzkaller.appspotmail.com>
Reported-by:  <syzbot+b972214bb803a343f4fe@syzkaller.appspotmail.com>
Fixes: 01d2f7e2 ("net/smc: sockopts TCP_NODELAY and TCP_CORK")
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 51d240a1

net/smc/af_smc.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -1680,14 +1680,18 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
		}
		break;
		case TCP_NODELAY:
		if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
		if (sk->sk_state != SMC_INIT &&
		sk->sk_state != SMC_LISTEN &&
		sk->sk_state != SMC_CLOSED) {
		if (val && !smc->use_fallback)
		mod_delayed_work(system_wq, &smc->conn.tx_work,
		0);
		}
		break;
		case TCP_CORK:
		if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
		if (sk->sk_state != SMC_INIT &&
		sk->sk_state != SMC_LISTEN &&
		sk->sk_state != SMC_CLOSED) {
		if (!val && !smc->use_fallback)
		mod_delayed_work(system_wq, &smc->conn.tx_work,
		0);