To get a send slot smc_wr_tx_get_free_slot() is called, which might
wait for a free slot. When smc_wr_tx_get_free_slot() returns there is a
check if the connection was killed in the meantime. In that case don't
only return an error, but also put back the free slot.

Fixes: b290098092e4 ("net/smc: cancel send and receive for terminated socket")
Reviewed-by: Ursula Braun <ubr...@linux.ibm.com>
Signed-off-by: Karsten Graul <kgr...@linux.ibm.com>
---
 net/smc/smc_cdc.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index a47e8855e045..ce468ff62a19 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -66,9 +66,13 @@ int smc_cdc_get_free_slot(struct smc_connection *conn,
        rc = smc_wr_tx_get_free_slot(link, smc_cdc_tx_handler, wr_buf,
                                     wr_rdma_buf,
                                     (struct smc_wr_tx_pend_priv **)pend);
-       if (conn->killed)
+       if (conn->killed) {
                /* abnormal termination */
+               if (!rc)
+                       smc_wr_tx_put_slot(link,
+                                          (struct smc_wr_tx_pend_priv *)pend);
                rc = -EPIPE;
+       }
        return rc;
 }
 
-- 
2.17.1

Reply via email to