diff options
| author | D. Wythe <alibuda@linux.alibaba.com> | 2023-11-03 09:07:38 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-11-06 13:01:07 +0300 |
| commit | 5211c9729484c923f8d2e06bd29f9322cc42bb8f (patch) | |
| tree | 4b7ec90ea3cbc136dcb5253670e487b5cdac7cc9 /net/smc/smc_cdc.c | |
| parent | d93f9528573e1d419b69ca5ff4130201d05f6b90 (diff) | |
| download | linux-5211c9729484c923f8d2e06bd29f9322cc42bb8f.tar.xz | |
net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
Considering scenario:
smc_cdc_rx_handler
__smc_release
sock_set_flag
smc_close_active()
sock_set_flag
__set_bit(DEAD) __set_bit(DONE)
Dues to __set_bit is not atomic, the DEAD or DONE might be lost.
if the DEAD flag lost, the state SMC_CLOSED will be never be reached
in smc_close_passive_work:
if (sock_flag(sk, SOCK_DEAD) &&
smc_close_sent_any_close(conn)) {
sk->sk_state = SMC_CLOSED;
} else {
/* just shutdown, but not yet closed locally */
sk->sk_state = SMC_APPFINCLOSEWAIT;
}
Replace sock_set_flags or __set_bit to set_bit will fix this problem.
Since set_bit is atomic.
Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/smc/smc_cdc.c')
| -rw-r--r-- | net/smc/smc_cdc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c index 89105e95b452..01bdb7909a14 100644 --- a/net/smc/smc_cdc.c +++ b/net/smc/smc_cdc.c @@ -385,7 +385,7 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc, smc->sk.sk_shutdown |= RCV_SHUTDOWN; if (smc->clcsock && smc->clcsock->sk) smc->clcsock->sk->sk_shutdown |= RCV_SHUTDOWN; - sock_set_flag(&smc->sk, SOCK_DONE); + smc_sock_set_flag(&smc->sk, SOCK_DONE); sock_hold(&smc->sk); /* sock_put in close_work */ if (!queue_work(smc_close_wq, &conn->close_work)) sock_put(&smc->sk); |