summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarsten Graul <kgraul@linux.ibm.com>2020-10-23 20:48:28 +0200
committerJakub Kicinski <kuba@kernel.org>2020-10-26 16:29:14 -0700
commit4a9baf45fd72615a804947a8495b73c4a0a4cb54 (patch)
tree11e2b78bc086e3056f74bca53ed5195682f689fe
parentaf545bb5ee53f5261db631db2ac4cde54038bdaf (diff)
net/smc: fix null pointer dereference in smc_listen_decline()
smc_listen_work() calls smc_listen_decline() on label out_decl, providing the ini pointer variable. But this pointer can still be null when the label out_decl is reached. Fix this by checking the ini variable in smc_listen_work() and call smc_listen_decline() with the result directly. Fixes: a7c9c5f4af7f ("net/smc: CLC accept / confirm V2") Signed-off-by: Karsten Graul <kgraul@linux.ibm.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-rw-r--r--net/smc/af_smc.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 82be0bd0f6e8..e9f487c8c6d5 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1317,10 +1317,10 @@ static void smc_listen_out_err(struct smc_sock *new_smc)
/* listen worker: decline and fall back if possible */
static void smc_listen_decline(struct smc_sock *new_smc, int reason_code,
- struct smc_init_info *ini, u8 version)
+ int local_first, u8 version)
{
/* RDMA setup failed, switch back to TCP */
- if (ini->first_contact_local)
+ if (local_first)
smc_lgr_cleanup_early(&new_smc->conn);
else
smc_conn_free(&new_smc->conn);
@@ -1768,7 +1768,8 @@ static void smc_listen_work(struct work_struct *work)
out_unlock:
mutex_unlock(&smc_server_lgr_pending);
out_decl:
- smc_listen_decline(new_smc, rc, ini, version);
+ smc_listen_decline(new_smc, rc, ini ? ini->first_contact_local : 0,
+ version);
out_free:
kfree(ini);
kfree(buf);