From: Pietro Borrello <borrello@diag.uniroma1.it>

Date: Thu, 9 Feb 2023 12:26:23 +0000

Subject: rds: rds_rm_zerocopy_callback() correct order for list_add_tail()

Git-commit: 68762148d1b011d47bc2ceed7321739b5aea1e63

Patch-mainline: v6.3-rc1

References: CVE-2023-1078 bsc#1208601

rds_rm_zerocopy_callback() uses list_add_tail() with swapped

arguments. This links the list head with the new entry, losing

the references to the remaining part of the list.

Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification")

Suggested-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>

Signed-off-by: David S. Miller <davem@davemloft.net>

Acked-by: Miroslav Franc <mfranc@suse.cz>

---

 net/rds/message.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rds/message.c b/net/rds/message.c

index c19c93561227..7af59d2443e5 100644

--- a/net/rds/message.c

+++ b/net/rds/message.c

@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,

 	ck = &info->zcookies;

 	memset(ck, 0, sizeof(*ck));

 	WARN_ON(!rds_zcookie_add(info, cookie));

-	list_add_tail(&q->zcookie_head, &info->rs_zcookie_next);

+	list_add_tail(&info->rs_zcookie_next, &q->zcookie_head);

 	spin_unlock_irqrestore(&q->lock, flags);

 	/* caller invokes rds_wake_sk_sleep() */