Merge branch 'smc-fixes'

Ursula Braun says:

====================
net/smc: fixes 2018-07-18

here are small fixes for SMC: The first patch speeds up unidirectional
traffic, the second patch increases security, and the third patch
fixes a problem for fallback cases.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 14 insertions, 4 deletions

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index c12a7fc18f56..6e5479067db0 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1456,7 +1456,8 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
 
         if (optlen < sizeof(int))
                 return -EINVAL;
-        get_user(val, (int __user *)optval);
+        if (get_user(val, (int __user *)optval))
+                return -EFAULT;
 
         lock_sock(sk);
         switch (optname) {
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 717449b1da0b..ae5d168653ce 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -250,6 +250,7 @@ out:
 int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
                      u8 expected_type)
 {
+        long rcvtimeo = smc->clcsock->sk->sk_rcvtimeo;
         struct sock *clc_sk = smc->clcsock->sk;
         struct smc_clc_msg_hdr *clcm = buf;
         struct msghdr msg = {NULL, 0};
@@ -306,7 +307,6 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
         memset(&msg, 0, sizeof(struct msghdr));
         iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen);
         krflags = MSG_WAITALL;
-        smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME;
         len = sock_recvmsg(smc->clcsock, &msg, krflags);
         if (len < datlen || !smc_clc_msg_hdr_valid(clcm)) {
                 smc->sk.sk_err = EPROTO;
@@ -322,6 +322,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
         }
 
 out:
+        smc->clcsock->sk->sk_rcvtimeo = rcvtimeo;
         return reason_code;
 }
 
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index cee666400752..f82886b7d1d8 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -495,7 +495,8 @@ out:
 
 void smc_tx_consumer_update(struct smc_connection *conn, bool force)
 {
-        union smc_host_cursor cfed, cons;
+        union smc_host_cursor cfed, cons, prod;
+        int sender_free = conn->rmb_desc->len;
         int to_confirm;
 
         smc_curs_write(&cons,
@@ -505,11 +506,18 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
                        smc_curs_read(&conn->rx_curs_confirmed, conn),
                        conn);
         to_confirm = smc_curs_diff(conn->rmb_desc->len, &cfed, &cons);
+        if (to_confirm > conn->rmbe_update_limit) {
+                smc_curs_write(&prod,
+                               smc_curs_read(&conn->local_rx_ctrl.prod, conn),
+                               conn);
+                sender_free = conn->rmb_desc->len -
+                              smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
+        }
 
         if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
             force ||
             ((to_confirm > conn->rmbe_update_limit) &&
-             ((to_confirm > (conn->rmb_desc->len / 2)) ||
+             ((sender_free <= (conn->rmb_desc->len / 2)) ||
               conn->local_rx_ctrl.prod_flags.write_blocked))) {
                 if ((smc_cdc_get_slot_and_msg_send(conn) < 0) &&
                     conn->alert_token_local) { /* connection healthy */