Unverified Commit b29ebe3b authored May 10, 2024 by openeuler-ci-bot Committed by Gitee May 10, 2024

!7053 CVE-2024-27024

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LMRYGKHFVGTB4AIMQCLIDPVVCTU7SSLL/ 
CVE-2024-27024

Edward Adam Davis (1):
  net/rds: fix WARNING in rds_conn_connect_if_down

Mahmoud Adam (1):
  net/rds: fix possible cp null dereference


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9L9M2 
 
Link:https://gitee.com/openeuler/kernel/pulls/7053

 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Reviewed-by: Liu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>

parents 22aee869 9418e1a8

net/rds/rdma.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -278,6 +278,9 @@ static int __rds_rdma_map(struct rds_sock rs, struct rds_get_mr_args args,
		put_page(sg_page(&sg[i]));
		kfree(sg);
		ret = PTR_ERR(trans_private);
		/* Trigger connection so that its ready for the next retry */
		if (ret == -ENODEV && cp)
		rds_conn_connect_if_down(cp->cp_conn);
		goto out;
		}

net/rds/send.c

+1 −5

Original line number	Diff line number	Diff line
		@@ -1300,12 +1300,8 @@ int rds_sendmsg(struct socket sock, struct msghdr msg, size_t payload_len)

		/* Parse any control messages the user may have included. */
		ret = rds_cmsg_send(rs, rm, msg, &allocated_mr, &vct);
		if (ret) {
		/* Trigger connection so that its ready for the next retry */
		if (ret == -EAGAIN)
		rds_conn_connect_if_down(conn);
		if (ret)
		goto out;
		}

		if (rm->rdma.op_active && !conn->c_trans->xmit_rdma) {
		printk_ratelimited(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n",