netdev - Re: [PATCH net-next] net/smc: unlock on error paths in __smc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89147077-fadc-e5fc-ce91-0f3d4403c5f2@linux.alibaba.com>
Date:   Sat, 19 Feb 2022 15:05:27 +0800
From:   "D. Wythe" <alibuda@...ux.alibaba.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>,
        Karsten Graul <kgraul@...ux.ibm.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, linux-s390@...r.kernel.org,
        netdev@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH net-next] net/smc: unlock on error paths in
 __smc_setsockopt()



在 2022/2/18 下午11:32, Dan Carpenter 写道:
> These two error paths need to release_sock(sk) before returning.
> 
> Fixes: a6a6fe27bab4 ("net/smc: Dynamic control handshake limitation by socket options")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> ---
>   net/smc/af_smc.c | 12 ++++++++----
>   1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index d873afe2d4dc..38faf2b60327 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -2715,10 +2715,14 @@ static int __smc_setsockopt(struct socket *sock, int level, int optname,
>   	lock_sock(sk);
>   	switch (optname) {
>   	case SMC_LIMIT_HS:
> -		if (optlen < sizeof(int))
> -			return -EINVAL;
> -		if (copy_from_sockptr(&val, optval, sizeof(int)))
> -			return -EFAULT;
> +		if (optlen < sizeof(int)) {
> +			rc = -EINVAL;
> +			break;
> +		}
> +		if (copy_from_sockptr(&val, optval, sizeof(int))) {
> +			rc = -EFAULT;
> +			break;
> +		}
>   
>   		smc->limit_smc_hs = !!val;
>   		rc = 0;

My mistake... thanks for your fixes.

Reviewed-by: D. Wythe <alibuda@...ux.alibaba.com>