diff options
| author | D. Wythe <alibuda@linux.alibaba.com> | 2023-11-03 14:07:38 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-11-20 11:08:29 +0100 |
| commit | a62af7146daa025c6e2915ca3e9da8f9a626bcd5 (patch) | |
| tree | fad40e178b54b10c6fc2dc35fe923ad3c64f5a43 /net | |
| parent | 866606826f16741b797220487ac2fabb7231e488 (diff) | |
| download | linux-a62af7146daa025c6e2915ca3e9da8f9a626bcd5.tar.gz linux-a62af7146daa025c6e2915ca3e9da8f9a626bcd5.tar.bz2 linux-a62af7146daa025c6e2915ca3e9da8f9a626bcd5.zip | |
net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
[ Upstream commit 5211c9729484c923f8d2e06bd29f9322cc42bb8f ]
Considering scenario:
smc_cdc_rx_handler
__smc_release
sock_set_flag
smc_close_active()
sock_set_flag
__set_bit(DEAD) __set_bit(DONE)
Dues to __set_bit is not atomic, the DEAD or DONE might be lost.
if the DEAD flag lost, the state SMC_CLOSED will be never be reached
in smc_close_passive_work:
if (sock_flag(sk, SOCK_DEAD) &&
smc_close_sent_any_close(conn)) {
sk->sk_state = SMC_CLOSED;
} else {
/* just shutdown, but not yet closed locally */
sk->sk_state = SMC_APPFINCLOSEWAIT;
}
Replace sock_set_flags or __set_bit to set_bit will fix this problem.
Since set_bit is atomic.
Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/smc/af_smc.c | 4 | ||||
| -rw-r--r-- | net/smc/smc.h | 5 | ||||
| -rw-r--r-- | net/smc/smc_cdc.c | 2 | ||||
| -rw-r--r-- | net/smc/smc_close.c | 2 |
4 files changed, 9 insertions, 4 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 9cdb7df0801f..49cf523a783a 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -145,7 +145,7 @@ static int __smc_release(struct smc_sock *smc) if (!smc->use_fallback) { rc = smc_close_active(smc); - sock_set_flag(sk, SOCK_DEAD); + smc_sock_set_flag(sk, SOCK_DEAD); sk->sk_shutdown |= SHUTDOWN_MASK; } else { if (sk->sk_state != SMC_CLOSED) { @@ -1334,7 +1334,7 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc) if (new_clcsock) sock_release(new_clcsock); new_sk->sk_state = SMC_CLOSED; - sock_set_flag(new_sk, SOCK_DEAD); + smc_sock_set_flag(new_sk, SOCK_DEAD); sock_put(new_sk); /* final */ *new_smc = NULL; goto out; diff --git a/net/smc/smc.h b/net/smc/smc.h index 930544f7b2e2..57e376756b91 100644 --- a/net/smc/smc.h +++ b/net/smc/smc.h @@ -315,4 +315,9 @@ static inline bool using_ipsec(struct smc_sock *smc) struct sock *smc_accept_dequeue(struct sock *parent, struct socket *new_sock); void smc_close_non_accepted(struct sock *sk); +static inline void smc_sock_set_flag(struct sock *sk, enum sock_flags flag) +{ + set_bit(flag, &sk->sk_flags); +} + #endif /* __SMC_H */ diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c index 41b23f71c29a..0823961ec2e6 100644 --- a/net/smc/smc_cdc.c +++ b/net/smc/smc_cdc.c @@ -370,7 +370,7 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc, smc->sk.sk_shutdown |= RCV_SHUTDOWN; if (smc->clcsock && smc->clcsock->sk) smc->clcsock->sk->sk_shutdown |= RCV_SHUTDOWN; - sock_set_flag(&smc->sk, SOCK_DONE); + smc_sock_set_flag(&smc->sk, SOCK_DONE); sock_hold(&smc->sk); /* sock_put in close_work */ if (!queue_work(smc_close_wq, &conn->close_work)) sock_put(&smc->sk); diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c index 149a59ecd299..0790cac9ae3e 100644 --- a/net/smc/smc_close.c +++ b/net/smc/smc_close.c @@ -170,7 +170,7 @@ void smc_close_active_abort(struct smc_sock *smc) break; } - sock_set_flag(sk, SOCK_DEAD); + smc_sock_set_flag(sk, SOCK_DEAD); sk->sk_state_change(sk); if (release_clcsock) { |