lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 19 Aug 2020 20:02:56 -0400 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Javed Hasan <jhasan@...vell.com>, Girish Basrur <gbasrur@...vell.com>, Santosh Vernekar <svernekar@...vell.com>, Saurav Kashyap <skashyap@...vell.com>, Shyam Sundar <ssundar@...vell.com>, "Martin K . Petersen" <martin.petersen@...cle.com>, Sasha Levin <sashal@...nel.org>, linux-scsi@...r.kernel.org Subject: [PATCH AUTOSEL 4.19 13/18] scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases From: Javed Hasan <jhasan@...vell.com> [ Upstream commit ec007ef40abb6a164d148b0dc19789a7a2de2cc8 ] In fc_disc_gpn_id_resp(), skb is supposed to get freed in all cases except for PTR_ERR. However, in some cases it didn't. This fix is to call fc_frame_free(fp) before function returns. Link: https://lore.kernel.org/r/20200729081824.30996-2-jhasan@marvell.com Reviewed-by: Girish Basrur <gbasrur@...vell.com> Reviewed-by: Santosh Vernekar <svernekar@...vell.com> Reviewed-by: Saurav Kashyap <skashyap@...vell.com> Reviewed-by: Shyam Sundar <ssundar@...vell.com> Signed-off-by: Javed Hasan <jhasan@...vell.com> Signed-off-by: Martin K. Petersen <martin.petersen@...cle.com> Signed-off-by: Sasha Levin <sashal@...nel.org> --- drivers/scsi/libfc/fc_disc.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c index 8839f509b19ab..78cf5b32bca67 100644 --- a/drivers/scsi/libfc/fc_disc.c +++ b/drivers/scsi/libfc/fc_disc.c @@ -593,8 +593,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, if (PTR_ERR(fp) == -FC_EX_CLOSED) goto out; - if (IS_ERR(fp)) - goto redisc; + if (IS_ERR(fp)) { + mutex_lock(&disc->disc_mutex); + fc_disc_restart(disc); + mutex_unlock(&disc->disc_mutex); + goto out; + } cp = fc_frame_payload_get(fp, sizeof(*cp)); if (!cp) @@ -621,7 +625,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, new_rdata->disc_id = disc->disc_id; fc_rport_login(new_rdata); } - goto out; + goto free_fp; } rdata->disc_id = disc->disc_id; mutex_unlock(&rdata->rp_mutex); @@ -638,6 +642,8 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, fc_disc_restart(disc); mutex_unlock(&disc->disc_mutex); } +free_fp: + fc_frame_free(fp); out: kref_put(&rdata->kref, fc_rport_destroy); if (!IS_ERR(fp)) -- 2.25.1
Powered by blists - more mailing lists