提交 cdaf25df 编写于 作者: D Dan Carpenter 提交者: David S. Miller

smc: some potential use after free bugs

Say we got really unlucky and these failed on the last iteration, then
it could lead to a use after free bug.

Fixes: cd6851f3 ("smc: remote memory buffers (RMBs)")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NUrsula Braun <ubraun@linux.vnet.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 1930b603
......@@ -532,6 +532,7 @@ int smc_sndbuf_create(struct smc_sock *smc)
__GFP_NORETRY);
if (!sndbuf_desc->cpu_addr) {
kfree(sndbuf_desc);
sndbuf_desc = NULL;
/* if send buffer allocation has failed,
* try a smaller one
*/
......@@ -543,6 +544,7 @@ int smc_sndbuf_create(struct smc_sock *smc)
if (rc) {
kfree(sndbuf_desc->cpu_addr);
kfree(sndbuf_desc);
sndbuf_desc = NULL;
continue; /* if mapping failed, try smaller one */
}
sndbuf_desc->used = 1;
......@@ -596,6 +598,7 @@ int smc_rmb_create(struct smc_sock *smc)
__GFP_NORETRY);
if (!rmb_desc->cpu_addr) {
kfree(rmb_desc);
rmb_desc = NULL;
/* if RMB allocation has failed,
* try a smaller one
*/
......@@ -607,6 +610,7 @@ int smc_rmb_create(struct smc_sock *smc)
if (rc) {
kfree(rmb_desc->cpu_addr);
kfree(rmb_desc);
rmb_desc = NULL;
continue; /* if mapping failed, try smaller one */
}
rc = smc_ib_get_memory_region(lgr->lnk[SMC_SINGLE_LINK].roce_pd,
......@@ -619,6 +623,7 @@ int smc_rmb_create(struct smc_sock *smc)
DMA_FROM_DEVICE);
kfree(rmb_desc->cpu_addr);
kfree(rmb_desc);
rmb_desc = NULL;
continue;
}
rmb_desc->used = 1;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册