lkml.org 
[lkml]   [2021]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.11 45/51] net/rds: Avoid potential use after free in rds_send_remove_from_sock
    Date
    From: Aditya Pakki <pakki001@umn.edu>

    [ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ]

    In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource
    is freed and later under spinlock, causing potential use-after-free.
    Set the free pointer to NULL to avoid undefined behavior.

    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/rds/message.c | 1 +
    net/rds/send.c | 2 +-
    2 files changed, 2 insertions(+), 1 deletion(-)

    diff --git a/net/rds/message.c b/net/rds/message.c
    index 071a261fdaab..90ebcfe5fe3b 100644
    --- a/net/rds/message.c
    +++ b/net/rds/message.c
    @@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm)
    rds_message_purge(rm);

    kfree(rm);
    + rm = NULL;
    }
    }
    EXPORT_SYMBOL_GPL(rds_message_put);
    diff --git a/net/rds/send.c b/net/rds/send.c
    index 985d0b7713ac..fe5264b9d4b3 100644
    --- a/net/rds/send.c
    +++ b/net/rds/send.c
    @@ -665,7 +665,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
    unlock_and_drop:
    spin_unlock_irqrestore(&rm->m_rs_lock, flags);
    rds_message_put(rm);
    - if (was_on_sock)
    + if (was_on_sock && rm)
    rds_message_put(rm);
    }

    --
    2.30.2
    \
     
     \ /
      Last update: 2021-04-12 18:26    [W:4.160 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site