|
Miroslav Franc |
b12ae5 |
From: Pietro Borrello <borrello@diag.uniroma1.it>
|
|
Miroslav Franc |
b12ae5 |
Date: Tue, 7 Feb 2023 18:26:34 +0000
|
|
Miroslav Franc |
b12ae5 |
Subject: rds: rds_rm_zerocopy_callback() use list_first_entry()
|
|
Miroslav Franc |
b12ae5 |
Git-commit: f753a68980cf4b59a80fe677619da2b1804f526d
|
|
Miroslav Franc |
b12ae5 |
Patch-mainline: v6.2-rc8
|
|
Miroslav Franc |
b12ae5 |
References: CVE-2023-1078 bsc#1208601
|
|
Miroslav Franc |
b12ae5 |
|
|
Miroslav Franc |
b12ae5 |
rds_rm_zerocopy_callback() uses list_entry() on the head of a list
|
|
Miroslav Franc |
b12ae5 |
causing a type confusion.
|
|
Miroslav Franc |
b12ae5 |
Use list_first_entry() to actually access the first element of the
|
|
Miroslav Franc |
b12ae5 |
rs_zcookie_queue list.
|
|
Miroslav Franc |
b12ae5 |
|
|
Miroslav Franc |
b12ae5 |
Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification")
|
|
Miroslav Franc |
b12ae5 |
Reviewed-by: Willem de Bruijn <willemb@google.com>
|
|
Miroslav Franc |
b12ae5 |
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
|
|
Miroslav Franc |
b12ae5 |
Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.it
|
|
Miroslav Franc |
b12ae5 |
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
Miroslav Franc |
b12ae5 |
Acked-by: Miroslav Franc <mfranc@suse.cz>
|
|
Miroslav Franc |
b12ae5 |
---
|
|
Miroslav Franc |
b12ae5 |
net/rds/message.c | 6 +++---
|
|
Miroslav Franc |
b12ae5 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
Miroslav Franc |
b12ae5 |
|
|
Miroslav Franc |
b12ae5 |
diff --git a/net/rds/message.c b/net/rds/message.c
|
|
Miroslav Franc |
b12ae5 |
index b47e4f0a1639..c19c93561227 100644
|
|
Miroslav Franc |
b12ae5 |
--- a/net/rds/message.c
|
|
Miroslav Franc |
b12ae5 |
+++ b/net/rds/message.c
|
|
Miroslav Franc |
b12ae5 |
@@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
|
|
Miroslav Franc |
b12ae5 |
spin_lock_irqsave(&q->lock, flags);
|
|
Miroslav Franc |
b12ae5 |
head = &q->zcookie_head;
|
|
Miroslav Franc |
b12ae5 |
if (!list_empty(head)) {
|
|
Miroslav Franc |
b12ae5 |
- info = list_entry(head, struct rds_msg_zcopy_info,
|
|
Miroslav Franc |
b12ae5 |
- rs_zcookie_next);
|
|
Miroslav Franc |
b12ae5 |
- if (info && rds_zcookie_add(info, cookie)) {
|
|
Miroslav Franc |
b12ae5 |
+ info = list_first_entry(head, struct rds_msg_zcopy_info,
|
|
Miroslav Franc |
b12ae5 |
+ rs_zcookie_next);
|
|
Miroslav Franc |
b12ae5 |
+ if (rds_zcookie_add(info, cookie)) {
|
|
Miroslav Franc |
b12ae5 |
spin_unlock_irqrestore(&q->lock, flags);
|
|
Miroslav Franc |
b12ae5 |
kfree(rds_info_from_znotifier(znotif));
|
|
Miroslav Franc |
b12ae5 |
/* caller invokes rds_wake_sk_sleep() */
|
|
Miroslav Franc |
b12ae5 |
|