Commit 4a9baf45 authored by Karsten Graul's avatar Karsten Graul Committed by Jakub Kicinski
Browse files

net/smc: fix null pointer dereference in smc_listen_decline() 



smc_listen_work() calls smc_listen_decline() on label out_decl,
providing the ini pointer variable. But this pointer can still be null
when the label out_decl is reached.
Fix this by checking the ini variable in smc_listen_work() and call
smc_listen_decline() with the result directly.

Fixes: a7c9c5f4 ("net/smc: CLC accept / confirm V2")
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent af545bb5

net/smc/af_smc.c

+4 −3
Original line number Diff line number Diff line
@@ -1317,10 +1317,10 @@ static void smc_listen_out_err(struct smc_sock *new_smc) 


/* listen worker: decline and fall back if possible */

static void smc_listen_decline(struct smc_sock *new_smc, int reason_code,

			       struct smc_init_info *ini, u8 version)

			       int local_first, u8 version)

{

	/* RDMA setup failed, switch back to TCP */

	if (ini->first_contact_local)

	if (local_first)

		smc_lgr_cleanup_early(&new_smc->conn);

	else

		smc_conn_free(&new_smc->conn);
@@ -1768,7 +1768,8 @@ static void smc_listen_work(struct work_struct *work) 
out_unlock:

	mutex_unlock(&smc_server_lgr_pending);

out_decl:

	smc_listen_decline(new_smc, rc, ini, version);

	smc_listen_decline(new_smc, rc, ini ? ini->first_contact_local : 0,

			   version);

out_free:

	kfree(ini);

	kfree(buf);