From: Cong Wang <xiyou.wangc...@gmail.com>
Date: Sat, 5 Jan 2019 23:45:26 -0800
> In smc_release() we release smc->clcsock before unhash the smc
> sock, but a parallel smc_diag_dump() may be still reading
> smc->clcsock, therefore this could cause a use-after-free as
> reported by syzbot.
>
> Reported-and-tested-by: syzbot+fbd1e5476e4c94c7b...@syzkaller.appspotmail.com
> Fixes: 51f1de79ad8e ("net/smc: replace sock_put worker by socket refcounting")
> Cc: Ursula Braun <ubr...@linux.ibm.com>
> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
We have two patches messing around in here, seeming to deal with release
visibility and ordering problems in two different ways.
https://patchwork.ozlabs.org/patch/1020608/
https://patchwork.ozlabs.org/patch/1021044/
Reported-by: syzbot+0bf2e01269f1274b4...@syzkaller.appspotmail.com
Reported-by: syzbot+e3132895630f95730...@syzkaller.appspotmail.com
