summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorUrsula Braun <ursula.braun@linux.ibm.com>2018-11-20 16:46:43 +0100
committerDavid S. Miller <davem@davemloft.net>2018-11-21 16:14:56 -0800
commite438bae43c1e08e688c09c410407b59fc1c173b4 (patch)
tree7325b43e2c0690f4f0944ae97096fda4cadefade
parentb9a22dd9811dbcddb5623c499e5b736400059df6 (diff)
downloadlinux-stable-e438bae43c1e08e688c09c410407b59fc1c173b4.tar.gz
linux-stable-e438bae43c1e08e688c09c410407b59fc1c173b4.tar.bz2
linux-stable-e438bae43c1e08e688c09c410407b59fc1c173b4.zip
net/smc: use after free fix in smc_wr_tx_put_slot()
In smc_wr_tx_put_slot() field pend->idx is used after being cleared. That means always idx 0 is cleared in the wr_tx_mask. This results in a broken administration of available WR send payload buffers. Signed-off-by: Ursula Braun <ubraun@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/smc/smc_wr.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 3c458d279855..c2694750a6a8 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
if (pend->idx < link->wr_tx_cnt) {
+ u32 idx = pend->idx;
+
/* clear the full struct smc_wr_tx_pend including .priv */
memset(&link->wr_tx_pends[pend->idx], 0,
sizeof(link->wr_tx_pends[pend->idx]));
memset(&link->wr_tx_bufs[pend->idx], 0,
sizeof(link->wr_tx_bufs[pend->idx]));
- test_and_clear_bit(pend->idx, link->wr_tx_mask);
+ test_and_clear_bit(idx, link->wr_tx_mask);
return 1;
}