diff options
| author |   Ursula Braun <ursula.braun@linux.ibm.com> | 2018-11-20 16:46:43 +0100 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-11-21 16:14:56 -0800 |
| commit | e438bae43c1e08e688c09c410407b59fc1c173b4 (patch) | |
| tree | 7325b43e2c0690f4f0944ae97096fda4cadefade /net/smc/smc_wr.c | |
| parent | net/smc: atomic SMCD cursor handling (diff) | |
| download | linux-dev-e438bae43c1e08e688c09c410407b59fc1c173b4.tar.xz linux-dev-e438bae43c1e08e688c09c410407b59fc1c173b4.zip | |
net/smc: use after free fix in smc_wr_tx_put_slot()
In smc_wr_tx_put_slot() field pend->idx is used after being
cleared. That means always idx 0 is cleared in the wr_tx_mask.
This results in a broken administration of available WR send
payload buffers.
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/smc/smc_wr.c')
| -rw-r--r-- | net/smc/smc_wr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c index 3c458d279855..c2694750a6a8 100644 --- a/net/smc/smc_wr.c +++ b/net/smc/smc_wr.c @@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link, pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv); if (pend->idx < link->wr_tx_cnt) { + u32 idx = pend->idx; + /* clear the full struct smc_wr_tx_pend including .priv */ memset(&link->wr_tx_pends[pend->idx], 0, sizeof(link->wr_tx_pends[pend->idx])); memset(&link->wr_tx_bufs[pend->idx], 0, sizeof(link->wr_tx_bufs[pend->idx])); - test_and_clear_bit(pend->idx, link->wr_tx_mask); + test_and_clear_bit(idx, link->wr_tx_mask); return 1; } |