iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/rds
History
Lv Yunlong c178e8a199 net/rds: Fix a use after free in rds_message_map_pages 
[ Upstream commit bdc2ab5c61a5c07388f4820ff21e787b4dfd1ced ]

In rds_message_map_pages, the rm is freed by rds_message_put(rm).
But rm is still used by rm->data.op_sg in return value.

My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is
freed to avoid the uaf.

Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-04-14 08:24:15 +02:00
..
af_rds.c
Convert usage of IN_MULTICAST to ipv4_is_multicast
2019-09-05 09:38:32 +02:00
bind.c
net/rds: Check laddr_check before calling it
2019-09-27 12:10:55 +02:00
cong.c
rds: Changing IP address internal representation to struct in6_addr
2018-07-23 21:17:44 -07:00
connection.c
rds: Return proper "tos" value to user-space
2019-07-09 21:45:42 -07:00
ib_cm.c
rds: ib: update WR sizes when bringing up connection
2019-11-16 12:59:08 -08:00
ib_fmr.c
net: rds: exchange of 8K and 1M pool
2019-04-24 12:07:08 -07:00
ib_frmr.c
net/rds: Keep track of and wait for FRWR segments in use upon shutdown
2019-07-17 12:06:52 -07:00
ib_mr.h
net/rds: Wait for the FRMR_IS_FREE (or FRMR_IS_STALE) transition after posting IB_WR_LOCAL_INV
2019-07-17 12:06:52 -07:00
ib_rdma.c
net/rds: Fix NULL/ERR_PTR inconsistency
2019-07-17 12:06:52 -07:00
ib_recv.c
net/rds: Whitelist rdma_cookie and rx_tstamp for usercopy
2019-08-23 14:55:52 -07:00
ib_ring.c
…
ib_send.c
rds: fix reordering with composite message notification
2019-07-09 21:45:41 -07:00
ib_stats.c
net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
2019-09-15 20:56:19 +02:00
ib_sysctl.c
…
ib.c
net/rds: Fix error handling in rds_ib_add_one()
2019-10-02 12:16:57 -04:00
ib.h
net: rds: add service level support in rds-info
2019-08-24 16:55:25 -07:00
info.c
mm/gup: change GUP fast to use flags rather than a write 'bool'
2019-05-14 09:47:46 -07:00
info.h
…
Kconfig
net: Fix Kconfig indentation
2019-09-26 08:56:17 +02:00
loop.c
rds: Changing IP address internal representation to struct in6_addr
2018-07-23 21:17:44 -07:00
loop.h
rds: clean up loopback rds_connections on netns deletion
2018-06-27 10:11:03 +09:00
Makefile
rds: remove trailing whitespace and blank lines
2018-07-24 14:10:42 -07:00
message.c
net/rds: Fix a use after free in rds_message_map_pages
2021-04-14 08:24:15 +02:00
page.c
…
rdma_transport.c
net: rds: add service level support in rds-info
2019-08-24 16:55:25 -07:00
rdma_transport.h
rds: rdma: add consumer reject
2019-02-04 14:59:11 -08:00
rdma.c
net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS
2021-02-17 10:35:19 +01:00
rds_single_path.h
…
rds.h
net/rds: Use ERR_PTR for rds_message_alloc_sgs()
2020-05-20 08:20:27 +02:00
recv.c
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 09:59:44 +02:00
send.c
net/rds: Use ERR_PTR for rds_message_alloc_sgs()
2020-05-20 08:20:27 +02:00
stats.c
rds: check for excessive looping in rds_send_xmit
2019-08-15 12:04:24 -07:00
sysctl.c
…
tcp_connect.c
rds: Enable RDS IPv6 support
2018-07-23 21:17:44 -07:00
tcp_listen.c
rds: add type of service(tos) infrastructure
2019-02-04 14:59:12 -08:00
tcp_recv.c
rds: Changing IP address internal representation to struct in6_addr
2018-07-23 21:17:44 -07:00
tcp_send.c
rds: Changing IP address internal representation to struct in6_addr
2018-07-23 21:17:44 -07:00
tcp_stats.c
…
tcp.c
net: rds: fix spelling mistake "syctl" -> "sysctl"
2019-05-05 10:19:43 -07:00
tcp.h
rds: Enable RDS IPv6 support
2018-07-23 21:17:44 -07:00
threads.c
rds: make v3.1 as compat version
2019-02-04 14:59:11 -08:00
transport.c
rds: remove trailing whitespace and blank lines
2018-07-24 14:10:42 -07:00