diff mbox series

[net] net/smc: do not schedule tx_work in SMC_CLOSED state

Message ID 20190802081638.56207-1-kgraul@linux.ibm.com
State Accepted
Delegated to: David Miller
Headers show
Series [net] net/smc: do not schedule tx_work in SMC_CLOSED state | expand

Commit Message

Karsten Graul Aug. 2, 2019, 8:16 a.m. UTC 
From: Ursula Braun <ubraun@linux.ibm.com>

The setsockopts options TCP_NODELAY and TCP_CORK may schedule the
tx worker. Make sure the socket is not yet moved into SMC_CLOSED
state (for instance by a shutdown SHUT_RDWR call).

Reported-by: syzbot+92209502e7aab127c75f@syzkaller.appspotmail.com
Reported-by: syzbot+b972214bb803a343f4fe@syzkaller.appspotmail.com
Fixes: 01d2f7e2cdd31 ("net/smc: sockopts TCP_NODELAY and TCP_CORK")
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
---
 net/smc/af_smc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

David Miller Aug. 5, 2019, 8:24 p.m. UTC | #1 
From: Karsten Graul <kgraul@linux.ibm.com>
Date: Fri,  2 Aug 2019 10:16:38 +0200

> From: Ursula Braun <ubraun@linux.ibm.com>
> 
> The setsockopts options TCP_NODELAY and TCP_CORK may schedule the
> tx worker. Make sure the socket is not yet moved into SMC_CLOSED
> state (for instance by a shutdown SHUT_RDWR call).
> 
> Reported-by: syzbot+92209502e7aab127c75f@syzkaller.appspotmail.com
> Reported-by: syzbot+b972214bb803a343f4fe@syzkaller.appspotmail.com
> Fixes: 01d2f7e2cdd31 ("net/smc: sockopts TCP_NODELAY and TCP_CORK")
> Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
> Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>

Applied and queued up for -stable.
diff mbox series

Patch

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 302e355f2ebc..f5ea09258ab0 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1732,14 +1732,18 @@  static int smc_setsockopt(struct socket *sock, int level, int optname,
 		}
 		break;
 	case TCP_NODELAY:
-		if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+		if (sk->sk_state != SMC_INIT &&
+		    sk->sk_state != SMC_LISTEN &&
+		    sk->sk_state != SMC_CLOSED) {
 			if (val && !smc->use_fallback)
 				mod_delayed_work(system_wq, &smc->conn.tx_work,
 						 0);
 		}
 		break;
 	case TCP_CORK:
-		if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+		if (sk->sk_state != SMC_INIT &&
+		    sk->sk_state != SMC_LISTEN &&
+		    sk->sk_state != SMC_CLOSED) {
 			if (!val && !smc->use_fallback)
 				mod_delayed_work(system_wq, &smc->conn.tx_work,
 						 0);