From: Karsten Graul <kgraul@linux.ibm.com>
Date: Sat, 18 Jul 2020 15:06:17 +0200
Subject: net/smc: remove freed buffer from list
Git-commit: fd7f3a746582e8b17c48d4d8087d38c91f59ba67
Patch-mainline: v5.8-rc7
References: git-fixes

Two buffers are allocated for each SMC connection. Each buffer is
added to a buffer list after creation. When the second buffer
allocation fails, the first buffer is freed but not deleted from
the list. This might result in crashes when another connection picks
up the freed buffer later and starts to work with it.

Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Fixes: 6511aad3f039 ("net/smc: change smc_buf_free function parameters")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ ptesarik: sndbufs_lock is a rwlock (not a mutex) because of missing
  commit faca536008375bece23783e7382b5d0356c13ba5. ]
Signed-off-by: Petr Tesarik <ptesarik@suse.com>
---
 net/smc/smc_core.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -966,8 +966,12 @@ int smc_buf_create(struct smc_sock *smc,
 		return rc;
 	/* create rmb */
 	rc = __smc_buf_create(smc, is_smcd, true);
-	if (rc)
+	if (rc) {
+		write_lock_bh(&smc->conn.lgr->sndbufs_lock);
+		list_del(&smc->conn.sndbuf_desc->list);
+		write_unlock_bh(&smc->conn.lgr->sndbufs_lock);
 		smc_buf_free(smc->conn.lgr, false, smc->conn.sndbuf_desc);
+	}
 	return rc;
 }