net/smc: fix refcount non-blocking connect() -part 2
If an SMC socket is immediately terminated after a non-blocking connect() has been called, a memory leak is possible. Due to the sock_hold move in commit301428ea37
("net/smc: fix refcounting for non-blocking connect()") an extra sock_put() is needed in smc_connect_work(), if the internal TCP socket is aborted and cancels the sk_stream_wait_connect() of the connect worker. Reported-by: syzbot+4b73ad6fc767e576e275@syzkaller.appspotmail.com Fixes:301428ea37
("net/smc: fix refcounting for non-blocking connect()") Signed-off-by: Ursula Braun <ubraun@linux.ibm.com> Signed-off-by: Karsten Graul <kgraul@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
1d4639567d
commit
6d6dd528d5
|
@ -796,6 +796,7 @@ static void smc_connect_work(struct work_struct *work)
|
|||
smc->sk.sk_err = EPIPE;
|
||||
else if (signal_pending(current))
|
||||
smc->sk.sk_err = -sock_intr_errno(timeo);
|
||||
sock_put(&smc->sk); /* passive closing */
|
||||
goto out;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue