Unverified Commit 81806b2b authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14911 net/smc: fix LGR and link use-after-free issue 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/CZ7FXR7DSIUJBNSMOIP34E4WGIMLHCNI/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBEAP5 
 
Link:https://gitee.com/openeuler/kernel/pulls/14911

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents db8975da 08db73fb

net/smc/af_smc.c

+2 −0
Original line number Diff line number Diff line
@@ -1901,6 +1901,7 @@ static void smc_listen_out(struct smc_sock *new_smc) 
	if (tcp_sk(new_smc->clcsock->sk)->syn_smc)

		atomic_dec(&lsmc->queued_smc_hs);



	release_sock(newsmcsk); /* lock in smc_listen_work() */

	if (lsmc->sk.sk_state == SMC_LISTEN) {

		lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);

		smc_accept_enqueue(&lsmc->sk, newsmcsk);
@@ -2422,6 +2423,7 @@ static void smc_listen_work(struct work_struct *work) 
	u8 accept_version;

	int rc = 0;



	lock_sock(&new_smc->sk); /* release in smc_listen_out() */

	if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN)

		return smc_listen_out_err(new_smc);