Re: [PATCH net] net/smc: fix TOCTOU race between smc_listen_out() and listener close
Breno Leitao <[email protected]>
| Newsgroups | gmane.linux.network |
|---|---|
| Message-ID | <[email protected]> |
> @@ -1931,11 +1931,12 @@ static void smc_listen_out(struct smc_sock *new_smc)
> atomic_dec(&lsmc->queued_smc_hs);
>
> release_sock(newsmcsk); /* lock in smc_listen_work() */
> + lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
> if (lsmc->sk.sk_state == SMC_LISTEN) {
> - lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
> smc_accept_enqueue(&lsmc->sk, newsmcsk);
> release_sock(&lsmc->sk);
> } else { /* no longer listening */
> + release_sock(&lsmc->sk);
> smc_close_non_accepted(newsmcsk);
> }
Do you need to call smc_close_non_accepted() without the lock? otherwise
you can have the lock around the whole if/else clause.