Unverified Commit 4cbb7363 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13221 aoe: fix the potential use-after-free problem in more places 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zicheng Qu <quzicheng@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/OCGSRUWKOBUXXQS2AFE4QP2GSGVYU3VK/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYR9W 
 
Link:https://gitee.com/openeuler/kernel/pulls/13221

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 592d168b 6ccd0329

drivers/block/aoe/aoecmd.c

+12 −1
Original line number Diff line number Diff line
@@ -362,6 +362,7 @@ ata_rw_frameinit(struct frame *f) 
	}



	ah->cmdstat = ATA_CMD_PIO_READ | writebit | extbit;

	dev_hold(t->ifp->nd);

	skb->dev = t->ifp->nd;

}
@@ -402,6 +403,8 @@ aoecmd_ata_rw(struct aoedev *d) 
		__skb_queue_head_init(&queue);

		__skb_queue_tail(&queue, skb);

		aoenet_xmit(&queue);

	} else {

		dev_put(f->t->ifp->nd);

	}

	return 1;

}
@@ -484,10 +487,13 @@ resend(struct aoedev *d, struct frame *f) 
	memcpy(h->dst, t->addr, sizeof h->dst);

	memcpy(h->src, t->ifp->nd->dev_addr, sizeof h->src);



	dev_hold(t->ifp->nd);

	skb->dev = t->ifp->nd;

	skb = skb_clone(skb, GFP_ATOMIC);

	if (skb == NULL)

	if (skb == NULL) {

		dev_put(t->ifp->nd);

		return;

	}

	f->sent = ktime_get();

	__skb_queue_head_init(&queue);

	__skb_queue_tail(&queue, skb);
@@ -618,6 +624,8 @@ probe(struct aoetgt *t) 
		__skb_queue_head_init(&queue);

		__skb_queue_tail(&queue, skb);

		aoenet_xmit(&queue);

	} else {

		dev_put(f->t->ifp->nd);

	}

}
@@ -1403,6 +1411,7 @@ aoecmd_ata_id(struct aoedev *d) 
	ah->cmdstat = ATA_CMD_ID_ATA;

	ah->lba3 = 0xa0;



	dev_hold(t->ifp->nd);

	skb->dev = t->ifp->nd;



	d->rttavg = RTTAVG_INIT;
@@ -1412,6 +1421,8 @@ aoecmd_ata_id(struct aoedev *d) 
	skb = skb_clone(skb, GFP_ATOMIC);

	if (skb)

		f->sent = ktime_get();

	else

		dev_put(t->ifp->nd);



	return skb;

}