Cong Wang 26d92e951f smc: move unhash as early as possible in smc_release() ... In smc_release() we release smc->clcsock before unhash the smc sock, but a parallel smc_diag_dump() may be still reading smc->clcsock, therefore this could cause a use-after-free as reported by syzbot. Reported-and-tested-by: syzbot+fbd1e5476e4c94c7b34e@syzkaller.appspotmail.com Fixes: 51f1de79ad ("net/smc: replace sock_put worker by socket refcounting") Cc: Ursula Braun <ubraun@linux.ibm.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Reported-by: syzbot+0bf2e01269f1274b4b03@syzkaller.appspotmail.com Reported-by: syzbot+e3132895630f957306bc@syzkaller.appspotmail.com Signed-off-by: David S. Miller <davem@davemloft.net>		2019-01-07 14:40:27 -05:00
..
Kconfig	…
Makefile	…
af_smc.c	smc: move unhash as early as possible in smc_release()	2019-01-07 14:40:27 -05:00
smc.h	net/smc: fix TCP fallback socket release	2018-12-18 22:02:51 -08:00
smc_cdc.c	net/smc: atomic SMCD cursor handling	2018-11-21 16:14:56 -08:00
smc_cdc.h	net/smc: atomic SMCD cursor handling	2018-11-21 16:14:56 -08:00
smc_clc.c	net/smc: short wait for late smc_clc_wait_msg	2018-11-23 17:20:32 -08:00
smc_clc.h	net/smc: short wait for late smc_clc_wait_msg	2018-11-23 17:20:32 -08:00
smc_close.c	…
smc_close.h	…
smc_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-11-24 17:01:43 -08:00
smc_core.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-11-24 17:01:43 -08:00
smc_diag.c	…
smc_ib.c	…
smc_ib.h	…
smc_ism.c	net/smc: add SMC-D shutdown signal	2018-11-21 16:14:56 -08:00
smc_ism.h	net/smc: add SMC-D shutdown signal	2018-11-21 16:14:56 -08:00
smc_llc.c	net/smc: add infrastructure to send delete rkey messages	2018-11-23 17:20:32 -08:00
smc_llc.h	net/smc: add infrastructure to send delete rkey messages	2018-11-23 17:20:32 -08:00
smc_pnet.c	…
smc_pnet.h	…
smc_rx.c	…
smc_rx.h	…
smc_tx.c	…
smc_tx.h	…
smc_wr.c	net/smc: use after free fix in smc_wr_tx_put_slot()	2018-11-21 16:14:56 -08:00
smc_wr.h	…