On 01/07/2019 04:12 PM, David Miller wrote:
> From: Cong Wang <xiyou.wangc...@gmail.com>
> Date: Sat, 5 Jan 2019 23:45:26 -0800
>
>> In smc_release() we release smc->clcsock before unhash the smc
>> sock, but a parallel smc_diag_dump() may be still reading
>> smc->clcsock, therefore this could cause a use-after-free as
>> reported by syzbot.
>>
>> Reported-and-tested-by: syzbot+fbd1e5476e4c94c7b...@syzkaller.appspotmail.com
>> Fixes: 51f1de79ad8e ("net/smc: replace sock_put worker by socket
>> refcounting")
>> Cc: Ursula Braun <ubr...@linux.ibm.com>
>> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
>
> We have two patches messing around in here, seeming to deal with release
> visibility and ordering problems in two different ways.
>
> https://patchwork.ozlabs.org/patch/1020608/
> https://patchwork.ozlabs.org/patch/1021044/
>
> Reported-by: syzbot+0bf2e01269f1274b4...@syzkaller.appspotmail.com
> Reported-by: syzbot+e3132895630f95730...@syzkaller.appspotmail.com
>
The patches from Myungho Jung fix a closing problem for listening SMC-sockets.
The patch by Cong Wang fixes a closing problem for SMC-sockets when
smc_diag_dump()
is running in parallel. Both are valuable in my eyes.
