On Mon, Jan 7, 2019 at 7:12 AM David Miller <da...@davemloft.net> wrote:
>
> From: Cong Wang <xiyou.wangc...@gmail.com>
> Date: Sat, 5 Jan 2019 23:45:26 -0800
>
> > In smc_release() we release smc->clcsock before unhash the smc
> > sock, but a parallel smc_diag_dump() may be still reading
> > smc->clcsock, therefore this could cause a use-after-free as
> > reported by syzbot.
> >
> > Reported-and-tested-by:
> > syzbot+fbd1e5476e4c94c7b...@syzkaller.appspotmail.com
> > Fixes: 51f1de79ad8e ("net/smc: replace sock_put worker by socket
> > refcounting")
> > Cc: Ursula Braun <ubr...@linux.ibm.com>
> > Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
>
> We have two patches messing around in here, seeming to deal with release
> visibility and ordering problems in two different ways.
>
> https://patchwork.ozlabs.org/patch/1020608/
> https://patchwork.ozlabs.org/patch/1021044/
>
> Reported-by: syzbot+0bf2e01269f1274b4...@syzkaller.appspotmail.com
> Reported-by: syzbot+e3132895630f95730...@syzkaller.appspotmail.com
Isn't Myungho's patch already merged as commit 78abe3d0dfad? :)
So I believe the syzbot reported this bug on top of that commit.
Thanks.
