diff options
| author | Ursula Braun <ursula.braun@linux.ibm.com> | 2018-11-20 16:46:43 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-12-17 20:38:01 +0100 |
| commit | 7d04bd4fe981cabd19eab3040a9facd4c74a8535 (patch) | |
| tree | 3557d26233b8ab581f94d91a8503e6cba951908c /net | |
| parent | 861e54e55ede06fc6f094baed3b3ab3fdeff64dd (diff) | |
net/smc: use after free fix in smc_wr_tx_put_slot()
[ Upstream commit e438bae43c1e08e688c09c410407b59fc1c173b4 ]
In smc_wr_tx_put_slot() field pend->idx is used after being
cleared. That means always idx 0 is cleared in the wr_tx_mask.
This results in a broken administration of available WR send
payload buffers.
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/smc/smc_wr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c index de4537f66832..ed6736a1a112 100644 --- a/net/smc/smc_wr.c +++ b/net/smc/smc_wr.c @@ -223,12 +223,14 @@ int smc_wr_tx_put_slot(struct smc_link *link, pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv); if (pend->idx < link->wr_tx_cnt) { + u32 idx = pend->idx; + /* clear the full struct smc_wr_tx_pend including .priv */ memset(&link->wr_tx_pends[pend->idx], 0, sizeof(link->wr_tx_pends[pend->idx])); memset(&link->wr_tx_bufs[pend->idx], 0, sizeof(link->wr_tx_bufs[pend->idx])); - test_and_clear_bit(pend->idx, link->wr_tx_mask); + test_and_clear_bit(idx, link->wr_tx_mask); return 1; } |