Unverified Commit 58f92ad6 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6291 aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ziyang Xuan <william.xuanziyang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/WGHS3RTBHRR25KYLVJZE7DSULZMRZRMD/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8TQCT 
 
Link:https://gitee.com/openeuler/kernel/pulls/6291

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 6e6bc0a8 e5c111ca

drivers/block/aoe/aoecmd.c

+6 −6
Original line number Diff line number Diff line
@@ -420,13 +420,16 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu 
	rcu_read_lock();

	for_each_netdev_rcu(&init_net, ifp) {

		dev_hold(ifp);

		if (!is_aoe_netif(ifp))

			goto cont;

		if (!is_aoe_netif(ifp)) {

			dev_put(ifp);

			continue;

		}



		skb = new_skb(sizeof *h + sizeof *ch);

		if (skb == NULL) {

			printk(KERN_INFO "aoe: skb alloc failure\n");

			goto cont;

			dev_put(ifp);

			continue;

		}

		skb_put(skb, sizeof *h + sizeof *ch);

		skb->dev = ifp;
@@ -441,9 +444,6 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu 
		h->major = cpu_to_be16(aoemajor);

		h->minor = aoeminor;

		h->cmd = AOECMD_CFG;



cont:

		dev_put(ifp);

	}

	rcu_read_unlock();

}

drivers/block/aoe/aoenet.c

+1 −0
Original line number Diff line number Diff line
@@ -64,6 +64,7 @@ tx(int id) __must_hold(&txlock) 
			pr_warn("aoe: packet could not be sent on %s.  %s\n",

				ifp ? ifp->name : "netif",

				"consider increasing tx_queue_len");

		dev_put(ifp);

		spin_lock_irq(&txlock);

	}

	return 0;