From: Stefan Raspl <raspl@linux.ibm.com>
Subject: net/smc: reduce sock_put() for fallback sockets
Patch-mainline: v4.18-rc6
Git-commit: e1bbdd57047454dad068dc36612dd60a57f4c58f
References: FATE#325698, LTC#167867, bsc#1113481

Description:  smc: Latest upstream fixes and extensions up to 8/17/2018

Upstream-Description:

              net/smc: reduce sock_put() for fallback sockets

              smc_release() calls a sock_put() for smc fallback sockets to cover
              the passive closing sock_hold() in __smc_connect() and
              smc_tcp_listen_work(). This does not make sense for sockets in state
              SMC_LISTEN and SMC_INIT.
              An SMC socket stays in state SMC_INIT if connect fails. The sock_put
              in smc_connect_abort() does not cover all failures. Move it into
              smc_connect_decline_fallback().

              Fixes: ee9dfbef02d18 ("net/smc: handle sockopts forcing fallback")
              Reported-by: syzbot+3a0748c8f2f210c0ef9b@syzkaller.appspotmail.com
              Reported-by: syzbot+9e60d2428a42049a592a@syzkaller.appspotmail.com
              Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
              Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Stefan Raspl <raspl@linux.ibm.com>
Acked-by: Petr Tesarik <ptesarik@suse.com>
---
 net/smc/af_smc.c    |   15 ++++++++++-----
 net/smc/smc_close.c |    2 ++
 2 files changed, 12 insertions(+), 5 deletions(-)

--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -147,7 +147,8 @@ static int smc_release(struct socket *so
 		smc->clcsock = NULL;
 	}
 	if (smc->use_fallback) {
-		sock_put(sk); /* passive closing */
+		if (sk->sk_state != SMC_LISTEN && sk->sk_state != SMC_INIT)
+			sock_put(sk); /* passive closing */
 		sk->sk_state = SMC_CLOSED;
 		sk->sk_state_change(sk);
 	}
@@ -417,12 +418,18 @@ static int smc_connect_decline_fallback(
 {
 	int rc;
 
-	if (reason_code < 0) /* error, fallback is not possible */
+	if (reason_code < 0) { /* error, fallback is not possible */
+		if (smc->sk.sk_state == SMC_INIT)
+			sock_put(&smc->sk); /* passive closing */
 		return reason_code;
+	}
 	if (reason_code != SMC_CLC_DECL_REPLY) {
 		rc = smc_clc_send_decline(smc, reason_code);
-		if (rc < 0)
+		if (rc < 0) {
+			if (smc->sk.sk_state == SMC_INIT)
+				sock_put(&smc->sk); /* passive closing */
 			return rc;
+		}
 	}
 	return smc_connect_fallback(smc);
 }
@@ -435,8 +442,6 @@ static int smc_connect_abort(struct smc_
 		smc_lgr_forget(smc->conn.lgr);
 	mutex_unlock(&smc_create_lgr_pending);
 	smc_conn_free(&smc->conn);
-	if (reason_code < 0 && smc->sk.sk_state == SMC_INIT)
-		sock_put(&smc->sk); /* passive closing */
 	return reason_code;
 }
 
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -106,6 +106,8 @@ static void smc_close_active_abort(struc
 	}
 	switch (sk->sk_state) {
 	case SMC_INIT:
+		sk->sk_state = SMC_PEERABORTWAIT;
+		break;
 	case SMC_ACTIVE:
 		sk->sk_state = SMC_PEERABORTWAIT;
 		release_sock(sk);