Linux-RDMA Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] net/rds: Avoid potential use after free in rds_send_remove_from_sock
@ 2021-04-07  0:09 Aditya Pakki
  2021-04-07 18:26 ` Santosh Shilimkar
                   ` (4 more replies)
  0 siblings, 5 replies; 9+ messages in thread
From: Aditya Pakki @ 2021-04-07  0:09 UTC (permalink / raw)
  To: pakki001
  Cc: Santosh Shilimkar, David S. Miller, Jakub Kicinski, netdev,
	linux-rdma, rds-devel, linux-kernel

In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource
is freed and later under spinlock, causing potential use-after-free.
Set the free pointer to NULL to avoid undefined behavior.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
---
 net/rds/message.c | 1 +
 net/rds/send.c    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rds/message.c b/net/rds/message.c
index 071a261fdaab..90ebcfe5fe3b 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm)
 		rds_message_purge(rm);
 
 		kfree(rm);
+		rm = NULL;
 	}
 }
 EXPORT_SYMBOL_GPL(rds_message_put);
diff --git a/net/rds/send.c b/net/rds/send.c
index 985d0b7713ac..fe5264b9d4b3 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -665,7 +665,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
 unlock_and_drop:
 		spin_unlock_irqrestore(&rm->m_rs_lock, flags);
 		rds_message_put(rm);
-		if (was_on_sock)
+		if (was_on_sock && rm)
 			rds_message_put(rm);
 	}
 
-- 
2.25.1


^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, back to index

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-07  0:09 [PATCH] net/rds: Avoid potential use after free in rds_send_remove_from_sock Aditya Pakki
2021-04-07 18:26 ` Santosh Shilimkar
2021-04-07 21:10 ` patchwork-bot+netdevbpf
2021-04-09 10:26 ` Eric Dumazet
2021-04-19 22:12 ` Al Viro
2021-04-20  9:09 ` Leon Romanovsky
2021-04-20  9:11   ` Leon Romanovsky
2021-04-21 14:19     ` Krzysztof Kozlowski
2021-04-21 15:36       ` Leon Romanovsky

Linux-RDMA Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-rdma/0 linux-rdma/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-rdma linux-rdma/ https://lore.kernel.org/linux-rdma \
		linux-rdma@vger.kernel.org
	public-inbox-index linux-rdma

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-rdma


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git