From: Cong Wang <[email protected]> Date: Sat, 5 Jan 2019 23:45:26 -0800
> In smc_release() we release smc->clcsock before unhash the smc > sock, but a parallel smc_diag_dump() may be still reading > smc->clcsock, therefore this could cause a use-after-free as > reported by syzbot. > > Reported-and-tested-by: [email protected] > Fixes: 51f1de79ad8e ("net/smc: replace sock_put worker by socket refcounting") > Cc: Ursula Braun <[email protected]> > Signed-off-by: Cong Wang <[email protected]> We have two patches messing around in here, seeming to deal with release visibility and ordering problems in two different ways. https://patchwork.ozlabs.org/patch/1020608/ https://patchwork.ozlabs.org/patch/1021044/ Reported-by: [email protected] Reported-by: [email protected]
