leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net/smc: fix null pointer dereference in smc_listen_decline()

Browse Source 
smc_listen_work() calls smc_listen_decline() on label out_decl,
providing the ini pointer variable. But this pointer can still be null
when the label out_decl is reached.
Fix this by checking the ini variable in smc_listen_work() and call
smc_listen_decline() with the result directly.

Fixes: a7c9c5f4af ("net/smc: CLC accept / confirm V2")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Karsten Graul 2020-10-23 20:48:28 +02:00 committed by Jakub Kicinski
parent af545bb5ee
commit 4a9baf45fd
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/smc/af_smc.c
View File

@ -1317,10 +1317,10 @@ static void smc_listen_out_err(struct smc_sock *new_smc)
/* listen worker: decline and fall back if possible */
static void smc_listen_decline(struct smc_sock *new_smc, int reason_code,
struct smc_init_info *ini, u8 version)
int local_first, u8 version)
{
/* RDMA setup failed, switch back to TCP */
if (ini->first_contact_local)
if (local_first)
smc_lgr_cleanup_early(&new_smc->conn);
else
smc_conn_free(&new_smc->conn);
@ -1768,7 +1768,8 @@ static void smc_listen_work(struct work_struct *work)
out_unlock:
mutex_unlock(&smc_server_lgr_pending);
out_decl:
smc_listen_decline(new_smc, rc, ini, version);
smc_listen_decline(new_smc, rc, ini ? ini->first_contact_local : 0,
version);
out_free:
kfree(ini);
kfree(buf);