Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Lv Yunlong c178e8a199 net/rds: Fix a use after free in rds_message_map_pages ... [ Upstream commit bdc2ab5c61a5c07388f4820ff21e787b4dfd1ced ] In rds_message_map_pages, the rm is freed by rds_message_put(rm). But rm is still used by rm->data.op_sg in return value. My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is freed to avoid the uaf. Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()") Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-04-14 08:24:15 +02:00
..
af_rds.c
bind.c
cong.c
connection.c
ib.c
ib.h
ib_cm.c
ib_fmr.c
ib_frmr.c
ib_mr.h
ib_rdma.c
ib_recv.c
ib_ring.c
ib_send.c
ib_stats.c
ib_sysctl.c
info.c
info.h
Kconfig
loop.c
loop.h
Makefile
message.c	net/rds: Fix a use after free in rds_message_map_pages	2021-04-14 08:24:15 +02:00
page.c
rdma.c	net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS	2021-02-17 10:35:19 +01:00
rdma_transport.c
rdma_transport.h
rds.h
rds_single_path.h
recv.c
send.c
stats.c
sysctl.c
tcp.c
tcp.h
tcp_connect.c
tcp_listen.c
tcp_recv.c
tcp_send.c
tcp_stats.c
threads.c
transport.c