4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karsten Graul kgraul@linux.ibm.com
[ Upstream commit 89ab066d4229acd32e323f1569833302544a4186 ]
This reverts commit dd979b4df817e9976f18fb6f9d134d6bc4a3c317.
This broke tcp_poll for SMC fallback: An AF_SMC socket establishes an internal TCP socket for the initial handshake with the remote peer. Whenever the SMC connection can not be established this TCP socket is used as a fallback. All socket operations on the SMC socket are then forwarded to the TCP socket. In case of poll, the file->private_data pointer references the SMC socket because the TCP socket has no file assigned. This causes tcp_poll to wait on the wrong socket.
Signed-off-by: Karsten Graul kgraul@linux.ibm.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- crypto/af_alg.c | 2 +- include/net/sock.h | 12 +++++++++--- net/atm/common.c | 2 +- net/caif/caif_socket.c | 2 +- net/core/datagram.c | 2 +- net/dccp/proto.c | 2 +- net/ipv4/tcp.c | 2 +- net/iucv/af_iucv.c | 2 +- net/nfc/llcp_sock.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/smc/af_smc.c | 2 +- net/tipc/socket.c | 2 +- net/unix/af_unix.c | 4 ++-- 13 files changed, 22 insertions(+), 16 deletions(-)
--- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -1071,7 +1071,7 @@ __poll_t af_alg_poll(struct file *file, struct af_alg_ctx *ctx = ask->private; __poll_t mask;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); mask = 0;
if (!ctx->more || ctx->used) --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2057,14 +2057,20 @@ static inline bool skwq_has_sleeper(stru /** * sock_poll_wait - place memory barrier behind the poll_wait call. * @filp: file + * @sock: socket to wait on * @p: poll_table * * See the comments in the wq_has_sleeper function. + * + * Do not derive sock from filp->private_data here. An SMC socket establishes + * an internal TCP socket that is used in the fallback case. All socket + * operations on the SMC socket are then forwarded to the TCP socket. In case of + * poll, the filp->private_data pointer references the SMC socket because the + * TCP socket has no file assigned. */ -static inline void sock_poll_wait(struct file *filp, poll_table *p) +static inline void sock_poll_wait(struct file *filp, struct socket *sock, + poll_table *p) { - struct socket *sock = filp->private_data; - if (!poll_does_not_wait(p)) { poll_wait(filp, &sock->wq->wait, p); /* We need to be sure we are in sync with the --- a/net/atm/common.c +++ b/net/atm/common.c @@ -653,7 +653,7 @@ __poll_t vcc_poll(struct file *file, str struct atm_vcc *vcc; __poll_t mask;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); mask = 0;
vcc = ATM_SD(sock); --- a/net/caif/caif_socket.c +++ b/net/caif/caif_socket.c @@ -941,7 +941,7 @@ static __poll_t caif_poll(struct file *f __poll_t mask; struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); mask = 0;
/* exceptional events? */ --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -838,7 +838,7 @@ __poll_t datagram_poll(struct file *file struct sock *sk = sock->sk; __poll_t mask;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); mask = 0;
/* exceptional events? */ --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@ -325,7 +325,7 @@ __poll_t dccp_poll(struct file *file, st __poll_t mask; struct sock *sk = sock->sk;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); if (sk->sk_state == DCCP_LISTEN) return inet_csk_listen_poll(sk);
--- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -507,7 +507,7 @@ __poll_t tcp_poll(struct file *file, str const struct tcp_sock *tp = tcp_sk(sk); int state;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait);
state = inet_sk_state_load(sk); if (state == TCP_LISTEN) --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -1505,7 +1505,7 @@ __poll_t iucv_sock_poll(struct file *fil struct sock *sk = sock->sk; __poll_t mask = 0;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait);
if (sk->sk_state == IUCV_LISTEN) return iucv_accept_poll(sk); --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -556,7 +556,7 @@ static __poll_t llcp_sock_poll(struct fi
pr_debug("%p\n", sk);
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait);
if (sk->sk_state == LLCP_LISTEN) return llcp_accept_poll(sk); --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c @@ -741,7 +741,7 @@ static __poll_t rxrpc_poll(struct file * struct rxrpc_sock *rx = rxrpc_sk(sk); __poll_t mask;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); mask = 0;
/* the socket is readable if there are any messages waiting on the Rx --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1543,7 +1543,7 @@ static __poll_t smc_poll(struct file *fi mask |= EPOLLERR; } else { if (sk->sk_state != SMC_CLOSED) - sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); if (sk->sk_err) mask |= EPOLLERR; if ((sk->sk_shutdown == SHUTDOWN_MASK) || --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -715,7 +715,7 @@ static __poll_t tipc_poll(struct file *f struct tipc_sock *tsk = tipc_sk(sk); __poll_t revents = 0;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait);
if (sk->sk_shutdown & RCV_SHUTDOWN) revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM; --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2640,7 +2640,7 @@ static __poll_t unix_poll(struct file *f struct sock *sk = sock->sk; __poll_t mask;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); mask = 0;
/* exceptional events? */ @@ -2677,7 +2677,7 @@ static __poll_t unix_dgram_poll(struct f unsigned int writable; __poll_t mask;
- sock_poll_wait(file, wait); + sock_poll_wait(file, sock, wait); mask = 0;
/* exceptional events? */