summaryrefslogtreecommitdiffstats
path: root/net/rds
diff options
context:
space:
mode:
authorAditya Pakki <pakki001@umn.edu>2021-04-06 19:09:12 -0500
committerDavid S. Miller <davem@davemloft.net>2021-04-07 14:01:24 -0700
commit0c85a7e87465f2d4cbc768e245f4f45b2f299b05 (patch)
treef653dfb46e6bd1f35733c346052343ee5be02643 /net/rds
parent5219d6012d46ec1fa3397e50bfeb7b8c16df72cf (diff)
downloadlinux-stable-0c85a7e87465f2d4cbc768e245f4f45b2f299b05.tar.gz
linux-stable-0c85a7e87465f2d4cbc768e245f4f45b2f299b05.tar.bz2
linux-stable-0c85a7e87465f2d4cbc768e245f4f45b2f299b05.zip
net/rds: Avoid potential use after free in rds_send_remove_from_sock
In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource is freed and later under spinlock, causing potential use-after-free. Set the free pointer to NULL to avoid undefined behavior. Signed-off-by: Aditya Pakki <pakki001@umn.edu> Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/rds')
-rw-r--r--net/rds/message.c1
-rw-r--r--net/rds/send.c2
2 files changed, 2 insertions, 1 deletions
diff --git a/net/rds/message.c b/net/rds/message.c
index 799034e0f513..4fc66ff0f1ec 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm)
rds_message_purge(rm);
kfree(rm);
+ rm = NULL;
}
}
EXPORT_SYMBOL_GPL(rds_message_put);
diff --git a/net/rds/send.c b/net/rds/send.c
index 985d0b7713ac..fe5264b9d4b3 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -665,7 +665,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
unlock_and_drop:
spin_unlock_irqrestore(&rm->m_rs_lock, flags);
rds_message_put(rm);
- if (was_on_sock)
+ if (was_on_sock && rm)
rds_message_put(rm);
}