lkml.org 
[lkml]   [2018]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.9 187/281] RDMA/iw_cxgb4: Avoid touch after free error in ARP failure handlers
    Date
    From: Raju Rangoju <rajur@chelsio.com>

    [ Upstream commit 1dad0ebeea1cd890b8892523f736916e245b0aef ]

    The patch 761e19a504af (RDMA/iw_cxgb4: Handle return value of
    c4iw_ofld_send() in abort_arp_failure()) from May 6, 2016
    leads to the following static checker warning:
    drivers/infiniband/hw/cxgb4/cm.c:575 abort_arp_failure()
    warn: passing freed memory 'skb'

    Also fixes skb leak when l2t resolution fails

    Fixes: 761e19a504afa55 (RDMA/iw_cxgb4: Handle return value of
    c4iw_ofld_send() in abort_arp_failure())
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Raju Rangoju <rajur@chelsio.com>
    Reviewed-by: Steve Wise <swise@opengridcomputing.com>
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    drivers/infiniband/hw/cxgb4/cm.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
    index 6512a555f7f8..dd18b74cd01d 100644
    --- a/drivers/infiniband/hw/cxgb4/cm.c
    +++ b/drivers/infiniband/hw/cxgb4/cm.c
    @@ -488,6 +488,7 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)

    ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
    release_ep_resources(ep);
    + kfree_skb(skb);
    return 0;
    }

    @@ -498,6 +499,7 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
    ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
    c4iw_put_ep(&ep->parent_ep->com);
    release_ep_resources(ep);
    + kfree_skb(skb);
    return 0;
    }

    @@ -569,11 +571,13 @@ static void abort_arp_failure(void *handle, struct sk_buff *skb)

    PDBG("%s rdev %p\n", __func__, rdev);
    req->cmd = CPL_ABORT_NO_RST;
    + skb_get(skb);
    ret = c4iw_ofld_send(rdev, skb);
    if (ret) {
    __state_set(&ep->com, DEAD);
    queue_arp_failure_cpl(ep, skb, FAKE_CPL_PUT_EP_SAFE);
    - }
    + } else
    + kfree_skb(skb);
    }

    static int send_flowc(struct c4iw_ep *ep)
    --
    2.14.1
    \
     
     \ /
      Last update: 2018-03-19 19:01    [W:2.085 / U:0.456 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site