diff options
| author | Karsten Graul <kgraul@linux.ibm.com> | 2020-10-23 20:48:28 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2020-10-26 16:29:14 -0700 |
| commit | 4a9baf45fd72615a804947a8495b73c4a0a4cb54 (patch) | |
| tree | 11e2b78bc086e3056f74bca53ed5195682f689fe /net/smc | |
| parent | af545bb5ee53f5261db631db2ac4cde54038bdaf (diff) | |
| download | linux-4a9baf45fd72615a804947a8495b73c4a0a4cb54.tar.gz linux-4a9baf45fd72615a804947a8495b73c4a0a4cb54.tar.bz2 linux-4a9baf45fd72615a804947a8495b73c4a0a4cb54.zip | |
net/smc: fix null pointer dereference in smc_listen_decline()
smc_listen_work() calls smc_listen_decline() on label out_decl,
providing the ini pointer variable. But this pointer can still be null
when the label out_decl is reached.
Fix this by checking the ini variable in smc_listen_work() and call
smc_listen_decline() with the result directly.
Fixes: a7c9c5f4af7f ("net/smc: CLC accept / confirm V2")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/smc')
| -rw-r--r-- | net/smc/af_smc.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 82be0bd0f6e8..e9f487c8c6d5 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1317,10 +1317,10 @@ static void smc_listen_out_err(struct smc_sock *new_smc) /* listen worker: decline and fall back if possible */ static void smc_listen_decline(struct smc_sock *new_smc, int reason_code, - struct smc_init_info *ini, u8 version) + int local_first, u8 version) { /* RDMA setup failed, switch back to TCP */ - if (ini->first_contact_local) + if (local_first) smc_lgr_cleanup_early(&new_smc->conn); else smc_conn_free(&new_smc->conn); @@ -1768,7 +1768,8 @@ static void smc_listen_work(struct work_struct *work) out_unlock: mutex_unlock(&smc_server_lgr_pending); out_decl: - smc_listen_decline(new_smc, rc, ini, version); + smc_listen_decline(new_smc, rc, ini ? ini->first_contact_local : 0, + version); out_free: kfree(ini); kfree(buf); |