Commit fd7f3a74 authored by Karsten Graul's avatar Karsten Graul Committed by David S. Miller

net/smc: remove freed buffer from list

Two buffers are allocated for each SMC connection. Each buffer is
added to a buffer list after creation. When the second buffer
allocation fails, the first buffer is freed but not deleted from
the list. This might result in crashes when another connection picks
up the freed buffer later and starts to work with it.
Reviewed-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
Fixes: 6511aad3 ("net/smc: change smc_buf_free function parameters")
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 741a49a4
...@@ -1772,8 +1772,12 @@ int smc_buf_create(struct smc_sock *smc, bool is_smcd) ...@@ -1772,8 +1772,12 @@ int smc_buf_create(struct smc_sock *smc, bool is_smcd)
return rc; return rc;
/* create rmb */ /* create rmb */
rc = __smc_buf_create(smc, is_smcd, true); rc = __smc_buf_create(smc, is_smcd, true);
if (rc) if (rc) {
mutex_lock(&smc->conn.lgr->sndbufs_lock);
list_del(&smc->conn.sndbuf_desc->list);
mutex_unlock(&smc->conn.lgr->sndbufs_lock);
smc_buf_free(smc->conn.lgr, false, smc->conn.sndbuf_desc); smc_buf_free(smc->conn.lgr, false, smc->conn.sndbuf_desc);
}
return rc; return rc;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment