net/rds: Fix a use after free in rds_message_map_pages
[ Upstream commit bdc2ab5c ] In rds_message_map_pages, the rm is freed by rds_message_put(rm). But rm is still used by rm->data.op_sg in return value. My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is freed to avoid the uaf. Fixes: 7dba9203 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()") Signed-off-by:Lv Yunlong <lyl2019@mail.ustc.edu.cn> Reviewed-by:
Håkon Bugge <haakon.bugge@oracle.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Sasha Levin <sashal@kernel.org>
parent
05bbe9d8
Please register or sign in to comment