diff options
| author | Karsten Graul <kgraul@linux.ibm.com> | 2020-07-18 15:06:18 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-07-20 00:30:23 +0200 |
| commit | 1ad24058335427d046b2e5666bcd15a62ad9e242 (patch) | |
| tree | d5011e7cb053277f387c64a1c9d1425f96327b5a /net/smc/af_smc.c | |
| parent | net/smc: remove freed buffer from list (diff) | |
| download | linux-1ad24058335427d046b2e5666bcd15a62ad9e242.tar.xz linux-1ad24058335427d046b2e5666bcd15a62ad9e242.zip | |
net/smc: fix restoring of fallback changes
When a listen socket is closed then all non-accepted sockets in its
accept queue are to be released. Inside __smc_release() the helper
smc_restore_fallback_changes() restores the changes done to the socket
without to check if the clcsocket has a file set. This can result in
a crash. Fix this by checking the file pointer first.
Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Fixes: f536dffc0b79 ("net/smc: fix closing of fallback SMC sockets")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/smc/af_smc.c')
| -rw-r--r-- | net/smc/af_smc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index d091509b5982..1163d51196da 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -126,8 +126,10 @@ EXPORT_SYMBOL_GPL(smc_proto6); static void smc_restore_fallback_changes(struct smc_sock *smc) { - smc->clcsock->file->private_data = smc->sk.sk_socket; - smc->clcsock->file = NULL; + if (smc->clcsock->file) { /* non-accepted sockets have no file yet */ + smc->clcsock->file->private_data = smc->sk.sk_socket; + smc->clcsock->file = NULL; + } } static int __smc_release(struct smc_sock *smc) |