net/smc: Avoid overwriting the copies of clcsock callback functions
authorWen Gu <guwen@linux.alibaba.com>
Wed, 9 Feb 2022 14:10:53 +0000 (22:10 +0800)
committerDavid S. Miller <davem@davemloft.net>
Fri, 11 Feb 2022 11:10:29 +0000 (11:10 +0000)
commit1de9770d121ee9294794cca0e0be8fbfa0134ee8
tree77ff12066badf957f909524b081bd2ad37c292e1
parentf1baf68e1383f6ed93eb9cff2866d46562607a43
net/smc: Avoid overwriting the copies of clcsock callback functions

The callback functions of clcsock will be saved and replaced during
the fallback. But if the fallback happens more than once, then the
copies of these callback functions will be overwritten incorrectly,
resulting in a loop call issue:

clcsk->sk_error_report
 |- smc_fback_error_report() <------------------------------|
     |- smc_fback_forward_wakeup()                          | (loop)
         |- clcsock_callback()  (incorrectly overwritten)   |
             |- smc->clcsk_error_report() ------------------|

So this patch fixes the issue by saving these function pointers only
once in the fallback and avoiding overwriting.

Reported-by: syzbot+4de3c0e8a263e1e499bc@syzkaller.appspotmail.com
Fixes: 341adeec9ada ("net/smc: Forward wakeup to smc socket waitqueue after fallback")
Link: https://lore.kernel.org/r/0000000000006d045e05d78776f6@google.com
Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/smc/af_smc.c