From: D. Wythe <alibuda@linux.alibaba.com>
Date: Fri, 3 Nov 2023 06:07:40 +0000 (+0800)
Subject: net/smc: put sk reference if close work was canceled
X-Git-Tag: v5.15.139~18
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ea06a23f8f47e5bfb32cba391d6e7609275f27c;p=thirdparty%2Fkernel%2Fstable.git

net/smc: put sk reference if close work was canceled

[ Upstream commit aa96fbd6d78d9770323b21e2c92bd38821be8852 ]

Note that we always hold a reference to sock when attempting
to submit close_work. Therefore, if we have successfully
canceled close_work from pending, we MUST release that reference
to avoid potential leaks.

Fixes: 42bfba9eaa33 ("net/smc: immediate termination for SMCD link groups")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 0790cac9ae3ee..bcd3ea894555d 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -113,7 +113,8 @@ static void smc_close_cancel_work(struct smc_sock *smc)
 	struct sock *sk = &smc->sk;
 
 	release_sock(sk);
-	cancel_work_sync(&smc->conn.close_work);
+	if (cancel_work_sync(&smc->conn.close_work))
+		sock_put(sk);
 	cancel_delayed_work_sync(&smc->conn.tx_work);
 	lock_sock(sk);
 }