net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT

[ Upstream commit 5211c9729484c923f8d2e06bd29f9322cc42bb8f ]

Considering scenario:

				smc_cdc_rx_handler
__smc_release
				sock_set_flag
smc_close_active()
sock_set_flag

__set_bit(DEAD)			__set_bit(DONE)

Dues to __set_bit is not atomic, the DEAD or DONE might be lost.
if the DEAD flag lost, the state SMC_CLOSED  will be never be reached
in smc_close_passive_work:

if (sock_flag(sk, SOCK_DEAD) &&
	smc_close_sent_any_close(conn)) {
	sk->sk_state = SMC_CLOSED;
} else {
	/* just shutdown, but not yet closed locally */
	sk->sk_state = SMC_APPFINCLOSEWAIT;
}

Replace sock_set_flags or __set_bit to set_bit will fix this problem.
Since set_bit is atomic.

Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 35ddebae88941b0c07d6ae1fa37511ada505c7a9..4c047e0e1625e763ea1839f4c2a09ff11b085d3e 100644 (file)
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -275,7 +275,7 @@ static int __smc_release(struct smc_sock *smc)
 
        if (!smc->use_fallback) {
                rc = smc_close_active(smc);
-               sock_set_flag(sk, SOCK_DEAD);
+               smc_sock_set_flag(sk, SOCK_DEAD);
                sk->sk_shutdown |= SHUTDOWN_MASK;
        } else {
                if (sk->sk_state != SMC_CLOSED) {
@@ -1743,7 +1743,7 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
                if (new_clcsock)
                        sock_release(new_clcsock);
                new_sk->sk_state = SMC_CLOSED;
-               sock_set_flag(new_sk, SOCK_DEAD);
+               smc_sock_set_flag(new_sk, SOCK_DEAD);
                sock_put(new_sk); /* final */
                *new_smc = NULL;
                goto out;

diff --git a/net/smc/smc.h b/net/smc/smc.h
index 24745fde4ac2641d307ada3d7f14b61e44f94694..e377980b84145dea53844b0ba080fd2fb25f80c0 100644 (file)
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -377,4 +377,9 @@ int smc_nl_dump_hs_limitation(struct sk_buff *skb, struct netlink_callback *cb);
 int smc_nl_enable_hs_limitation(struct sk_buff *skb, struct genl_info *info);
 int smc_nl_disable_hs_limitation(struct sk_buff *skb, struct genl_info *info);
 
+static inline void smc_sock_set_flag(struct sock *sk, enum sock_flags flag)
+{
+       set_bit(flag, &sk->sk_flags);
+}
+
 #endif /* __SMC_H */

diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 89105e95b4523f0a0d197e7167f27914430f482e..01bdb7909a14b4c73febdb40ff124cbfccb5b8c5 100644 (file)
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -385,7 +385,7 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc,
                smc->sk.sk_shutdown |= RCV_SHUTDOWN;
                if (smc->clcsock && smc->clcsock->sk)
                        smc->clcsock->sk->sk_shutdown |= RCV_SHUTDOWN;
-               sock_set_flag(&smc->sk, SOCK_DONE);
+               smc_sock_set_flag(&smc->sk, SOCK_DONE);
                sock_hold(&smc->sk); /* sock_put in close_work */
                if (!queue_work(smc_close_wq, &conn->close_work))
                        sock_put(&smc->sk);

diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index dbdf03e8aa5b55f29d71e9f7c28169cac358740f..449ef454b53be982dc7229b2fe4dc5fba414dd1c 100644 (file)
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -173,7 +173,7 @@ void smc_close_active_abort(struct smc_sock *smc)
                break;
        }
 
-       sock_set_flag(sk, SOCK_DEAD);
+       smc_sock_set_flag(sk, SOCK_DEAD);
        sk->sk_state_change(sk);
 
        if (release_clcsock) {