Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: Re: [PATCH v2] net/rds: Fix a use after free in rds_message_map_pages
From:   patchwork-bot+netdevbpf@kernel.org
Message-Id: <161722620780.13975.16375102859564408293.git-patchwork-notify@kernel.org>
Date:   Wed, 31 Mar 2021 21:30:07 +0000
References: <20210331015959.4404-1-lyl2019@mail.ustc.edu.cn>
In-Reply-To: <20210331015959.4404-1-lyl2019@mail.ustc.edu.cn>
To:     Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc:     santosh.shilimkar@oracle.com, davem@davemloft.net, kuba@kernel.org,
        netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
        rds-devel@oss.oracle.com, linux-kernel@vger.kernel.org
Precedence: bulk

Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Tue, 30 Mar 2021 18:59:59 -0700 you wrote:
> In rds_message_map_pages, the rm is freed by rds_message_put(rm).
> But rm is still used by rm->data.op_sg in return value.
> 
> My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is
> freed to avoid the uaf.
> 
> Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
> 
> [...]

Here is the summary with links:
  - [v2] net/rds: Fix a use after free in rds_message_map_pages
    https://git.kernel.org/netdev/net/c/bdc2ab5c61a5

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html