summaryrefslogtreecommitdiffstats
path: root/net/rds
diff options
context:
space:
mode:
authorLv Yunlong <lyl2019@mail.ustc.edu.cn>2021-03-31 03:59:59 +0200
committerDavid S. Miller <davem@davemloft.net>2021-03-31 23:26:56 +0200
commitbdc2ab5c61a5c07388f4820ff21e787b4dfd1ced (patch)
treee4de98593b2567237161731b200b533b4de41f87 /net/rds
parentneighbour: Disregard DEAD dst in neigh_update (diff)
downloadlinux-bdc2ab5c61a5c07388f4820ff21e787b4dfd1ced.tar.xz
linux-bdc2ab5c61a5c07388f4820ff21e787b4dfd1ced.zip
net/rds: Fix a use after free in rds_message_map_pages
In rds_message_map_pages, the rm is freed by rds_message_put(rm). But rm is still used by rm->data.op_sg in return value. My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is freed to avoid the uaf. Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()") Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Reviewed-by: HÃ¥kon Bugge <haakon.bugge@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/rds')
-rw-r--r--net/rds/message.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/rds/message.c b/net/rds/message.c
index 071a261fdaab..799034e0f513 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -347,8 +347,9 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE);
rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
if (IS_ERR(rm->data.op_sg)) {
+ void *err = ERR_CAST(rm->data.op_sg);
rds_message_put(rm);
- return ERR_CAST(rm->data.op_sg);
+ return err;
}
for (i = 0; i < rm->data.op_nents; ++i) {