[PATCH] net/smc: Fix socket use-after-free in smc_shutdown()

In the fallback path, smc_shutdown() drops the passive closing
reference on the socket with sock_put() and then still uses the socket
by calling release_sock() at the out label. If that reference is the
last one, for example because the passive closing reference was
already consumed by an abort of the active link group, the socket is
freed while it is still in use.

Move the sock_put() after release_sock() so the socket is only dropped
once it is no longer used.

Fixes: 1a74e9932374 ("net/smc: Fix sock leak when release after smc_shutdown()")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <redacted>
---
 net/smc/af_smc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index dffbd529762d..420701762c8d 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c

@@ -2943,6 +2943,7 @@ int smc_shutdown(struct socket *sock, int how)
 {
 	struct sock *sk = sock->sk;
 	bool do_shutdown = true;
+	bool passive_close = false;
 	struct smc_sock *smc;
 	int rc = -EINVAL;
 	int old_state;

@@ -2980,7 +2981,7 @@ int smc_shutdown(struct socket *sock, int how)
 		if (sk->sk_shutdown == SHUTDOWN_MASK) {
 			sk->sk_state = SMC_CLOSED;
 			sk->sk_socket->state = SS_UNCONNECTED;
-			sock_put(sk);
+			passive_close = true;
 		}
 		goto out;
 	}

@@ -3011,6 +3012,8 @@ int smc_shutdown(struct socket *sock, int how)
 		sock->state = SS_DISCONNECTING;
 out:
 	release_sock(sk);
+	if (passive_close)
+		sock_put(sk); /* passive closing */
 	return rc ? rc : rc1;
 }
 

-- 
2.34.1