From: Karsten Graul <kgraul@xxxxxxxxxxxxx>
Date: Tue, 12 Nov 2019 16:03:41 +0100
> From: Ursula Braun <ubraun@xxxxxxxxxxxxx>
>
> If an SMC socket is immediately terminated after a non-blocking connect()
> has been called, a memory leak is possible.
> Due to the sock_hold move in
> commit 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()")
> an extra sock_put() is needed in smc_connect_work(), if the internal
> TCP socket is aborted and cancels the sk_stream_wait_connect() of the
> connect worker.
>
> Reported-by: syzbot+4b73ad6fc767e576e275@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()")
> Signed-off-by: Ursula Braun <ubraun@xxxxxxxxxxxxx>
> Signed-off-by: Karsten Graul <kgraul@xxxxxxxxxxxxx>
Applied.
And since 301428ea3708 went to -stable, I'll queue this up too.
Thanks.
