diff options
| author | Ursula Braun <ubraun@linux.vnet.ibm.com> | 2018-04-19 15:56:40 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-04-19 22:38:39 +0200 |
| commit | 1255fcb2a655f05e02f3a74675a6d6525f187afd (patch) | |
| tree | cae7571656a85e8c76109813874fa4521fdd003b /net/smc | |
| parent | bnxt_en: Fix memory fault in bnxt_ethtool_init() (diff) | |
| download | linux-1255fcb2a655f05e02f3a74675a6d6525f187afd.tar.xz linux-1255fcb2a655f05e02f3a74675a6d6525f187afd.zip | |
net/smc: fix shutdown in state SMC_LISTEN
Calling shutdown with SHUT_RD and SHUT_RDWR for a listening SMC socket
crashes, because
commit 127f49705823 ("net/smc: release clcsock from tcp_listen_worker")
releases the internal clcsock in smc_close_active() and sets smc->clcsock
to NULL.
For SHUT_RD the smc_close_active() call is removed.
For SHUT_RDWR the kernel_sock_shutdown() call is omitted, since the
clcsock is already released.
Fixes: 127f49705823 ("net/smc: release clcsock from tcp_listen_worker")
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/smc')
| -rw-r--r-- | net/smc/af_smc.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 5f8046c62d90..f5d4b69dbabc 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1259,14 +1259,12 @@ static int smc_shutdown(struct socket *sock, int how) rc = smc_close_shutdown_write(smc); break; case SHUT_RD: - if (sk->sk_state == SMC_LISTEN) - rc = smc_close_active(smc); - else - rc = 0; - /* nothing more to do because peer is not involved */ + rc = 0; + /* nothing more to do because peer is not involved */ break; } - rc1 = kernel_sock_shutdown(smc->clcsock, how); + if (smc->clcsock) + rc1 = kernel_sock_shutdown(smc->clcsock, how); /* map sock_shutdown_cmd constants to sk_shutdown value range */ sk->sk_shutdown |= how + 1; |