netdev - Re: [PATCH net 1/1] net/smc: save link group ptr before calling smc_buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20181023.110057.1998437403503010569.davem@davemloft.net>
Date:   Tue, 23 Oct 2018 11:00:57 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     ubraun@...ux.ibm.com
Cc:     netdev@...r.kernel.org, linux-s390@...r.kernel.org,
        schwidefsky@...ibm.com, heiko.carstens@...ibm.com,
        raspl@...ux.ibm.com
Subject: Re: [PATCH net 1/1] net/smc: save link group ptr before calling
 smc_buf_unuse

From: Ursula Braun <ubraun@...ux.ibm.com>
Date: Tue, 23 Oct 2018 15:48:05 +0200

> @@ -315,6 +314,8 @@ static void smc_buf_unuse(struct smc_connection *conn)
>  /* remove a finished connection from its link group */
>  void smc_conn_free(struct smc_connection *conn)
>  {
> +	struct smc_link_group *lgr;
> +
>  	if (!conn->lgr)
>  		return;
>  	if (conn->lgr->is_smcd) {
> @@ -323,8 +324,9 @@ void smc_conn_free(struct smc_connection *conn)
>  	} else {
>  		smc_cdc_tx_dismiss_slots(conn);
>  	}
> +	lgr = conn->lgr; /* smc_lgr_unregister_conn() unsets lgr */
>  	smc_lgr_unregister_conn(conn);
> -	smc_buf_unuse(conn);
> +	smc_buf_unuse(conn, lgr);
>  }

This doesn't make any sense.

smc_lgr_unregister_conn() can free the memory and release the object,
albeit sometimes asynchronously via a workqueue.

It is not safe, therefore, to refrence the lgr object after that
function call.

I'm not applying this, sorry.