diff --git a/patches.suse/net-smc-fix-refcount-non-blocking-connect-part-2 b/patches.suse/net-smc-fix-refcount-non-blocking-connect-part-2 new file mode 100644 index 0000000..4cea5e1 --- /dev/null +++ b/patches.suse/net-smc-fix-refcount-non-blocking-connect-part-2 @@ -0,0 +1,35 @@ +From: Ursula Braun +Date: Tue, 12 Nov 2019 16:03:41 +0100 +Subject: net/smc: fix refcount non-blocking connect() -part 2 +Git-commit: 6d6dd528d5af05dc2d0c773951ed68d630a0c3f1 +Patch-mainline: v5.4-rc8 +References: git-fixes + +If an SMC socket is immediately terminated after a non-blocking connect() +has been called, a memory leak is possible. +Due to the sock_hold move in +commit 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()") +an extra sock_put() is needed in smc_connect_work(), if the internal +TCP socket is aborted and cancels the sk_stream_wait_connect() of the +connect worker. + +Reported-by: syzbot+4b73ad6fc767e576e275@syzkaller.appspotmail.com +Fixes: 301428ea3708 ("net/smc: fix refcounting for non-blocking connect()") +Signed-off-by: Ursula Braun +Signed-off-by: Karsten Graul +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + net/smc/af_smc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -785,6 +785,7 @@ static void smc_connect_work(struct work + smc->sk.sk_err = EPIPE; + else if (signal_pending(current)) + smc->sk.sk_err = -sock_intr_errno(timeo); ++ sock_put(&smc->sk); /* passive closing */ + goto out; + } + diff --git a/series.conf b/series.conf index 4a85b69..5879458 100644 --- a/series.conf +++ b/series.conf @@ -26341,6 +26341,7 @@ patches.suse/Input-synaptics-rmi4-destroy-F54-poller-workqueue-wh.patch patches.suse/mm-debug.c-PageAnon-is-true-for-PageKsm-pages.patch patches.suse/NFC-nxp-nci-Fix-NULL-pointer-dereference-after-I2C-c.patch + patches.suse/net-smc-fix-refcount-non-blocking-connect-part-2 patches.suse/net-usb-qmi_wwan-add-support-for-Foxconn-T77W968-LTE.patch patches.suse/slip-Fix-memory-leak-in-slip_open-error-path.patch patches.suse/net-cdc_ncm-Signedness-bug-in-cdc_ncm_set_dgram_size.patch