Message ID | 5a4d45ce.8b8a1c0a.1d072.e5e1@mx.google.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
Series | RDS: null pointer dereference in rds_atomic_free_op | expand |
On 1/3/2018 1:06 PM, simo.ghannam@gmail.com wrote: > From: Mohamed Ghannam <simo.ghannam@gmail.com> > > set rm->atomic.op_active to 0 when rds_pin_pages() fails > or the user supplied address is invalid, > this prevents a NULL pointer usage in rds_atomic_free_op() > > Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com> > --- Good catch !! Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
From: simo.ghannam@gmail.com Date: Wed, 3 Jan 2018 21:06:06 +0000 > From: Mohamed Ghannam <simo.ghannam@gmail.com> > > set rm->atomic.op_active to 0 when rds_pin_pages() fails > or the user supplied address is invalid, > this prevents a NULL pointer usage in rds_atomic_free_op() > > Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com> Applied and queued up for -stable, thanks.
diff --git a/net/rds/rdma.c b/net/rds/rdma.c index bc2f1e0977d6..398932fbaf27 100644 --- a/net/rds/rdma.c +++ b/net/rds/rdma.c @@ -874,6 +874,7 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm, err: if (page) put_page(page); + rm->atomic.op_active = 0; kfree(rm->atomic.op_notifier); return ret;