[PATCH net] net/smc: fix using of uninitialized completions

[PATCH net] net/smc: fix using of uninitialized completions

[Karsten Graul]

In smc_wr_tx_send_wait() the completion on index specified by
pend->idx is initialized and after smc_wr_tx_send() was called the wait
for completion starts. pend->idx is used to get the correct index for
the wait, but the pend structure could already be cleared in
smc_wr_tx_process_cqe().
Introduce pnd_idx to hold and use a local copy of the correct index.

Fixes: 09c61d24f96d ("net/smc: wait for departure of an IB message")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
---
 net/smc/smc_wr.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 600ab5889227..79a7431f534e 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -358,18 +358,20 @@ int smc_wr_tx_send_wait(struct smc_link *link, struct smc_wr_tx_pend_priv *priv,
 			unsigned long timeout)
 {
 	struct smc_wr_tx_pend *pend;
+	u32 pnd_idx;
 	int rc;
 
 	pend = container_of(priv, struct smc_wr_tx_pend, priv);
 	pend->compl_requested = 1;
-	init_completion(&link->wr_tx_compl[pend->idx]);
+	pnd_idx = pend->idx;
+	init_completion(&link->wr_tx_compl[pnd_idx]);
 
 	rc = smc_wr_tx_send(link, priv);
 	if (rc)
 		return rc;
 	/* wait for completion by smc_wr_tx_process_cqe() */
 	rc = wait_for_completion_interruptible_timeout(
-					&link->wr_tx_compl[pend->idx], timeout);
+					&link->wr_tx_compl[pnd_idx], timeout);
 	if (rc <= 0)
 		rc = -ENODATA;
 	if (rc > 0)
-- 
2.32.0

Re: [PATCH net] net/smc: fix using of uninitialized completions

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Mon, 27 Dec 2021 14:35:30 +0100 you wrote:
> In smc_wr_tx_send_wait() the completion on index specified by
> pend->idx is initialized and after smc_wr_tx_send() was called the wait
> for completion starts. pend->idx is used to get the correct index for
> the wait, but the pend structure could already be cleared in
> smc_wr_tx_process_cqe().
> Introduce pnd_idx to hold and use a local copy of the correct index.
> 
> [...]

Here is the summary with links:
  - [net] net/smc: fix using of uninitialized completions
    https://git.kernel.org/netdev/net/c/6d7373dabfd3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html