Commit 4c7c6c0d authored Mar 08, 2023 by Pietro Borrello Committed by Jialin Zhang Mar 08, 2023

rds: rds_rm_zerocopy_callback() use list_first_entry()

stable inclusion
from stable-v5.10.168
commit c53f34ec3fbf3e9f67574118a6bb35ae1146f7ca
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7UF
CVE: CVE-2023-1078

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c53f34ec3fbf3e9f67574118a6bb35ae1146f7ca



-------------------------------------------------

[ Upstream commit f753a689 ]

rds_rm_zerocopy_callback() uses list_entry() on the head of a list
causing a type confusion.
Use list_first_entry() to actually access the first element of the
rs_zcookie_queue list.

Fixes: 9426bbc6 ("rds: use list structure to track information for zerocopy completion notification")
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.it


Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lu Wei <luwei32@huawei.com>
Reviewed-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Wang Weiyang <wangweiyang2@huawei.com>
Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>

parent eceec949

net/rds/message.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
		spin_lock_irqsave(&q->lock, flags);
		head = &q->zcookie_head;
		if (!list_empty(head)) {
		info = list_entry(head, struct rds_msg_zcopy_info,
		info = list_first_entry(head, struct rds_msg_zcopy_info,
		rs_zcookie_next);
		if (info && rds_zcookie_add(info, cookie)) {
		if (rds_zcookie_add(info, cookie)) {
		spin_unlock_irqrestore(&q->lock, flags);
		kfree(rds_info_from_znotifier(znotif));
		/* caller invokes rds_wake_sk_sleep() */