Whamcloud - gitweb
LU-12101 socklnd: fix infinite loop in ksocknal_push() 99/34499/4
authorNeilBrown <neilb@suse.com>
Thu, 27 Jun 2019 15:18:36 +0000 (11:18 -0400)
committerOleg Drokin <green@whamcloud.com>
Fri, 12 Jul 2019 05:21:43 +0000 (05:21 +0000)
If the list_for_each_entry() loop in ksocknal_push()
ever finds a match, then it will increment 'i', and the outer
loop will continue.

Once peer_off becomes larger than the number of matches
in a given chain, 'peer_ni' will be an invalid pointer, and
ksocknal_push_peer() will probably crash when called on it.

To abort the outer loop properly, we need to test if
"i <= peer_off", which indicates that all patching peers
have been found.

This bug can easily be reproduced by running
  lctl --net tcp push

Signed-off-by: Mr NeilBrown <neilb@suse.com>
Change-Id: I9468214c7e1a0154213586cac0deb61afaa1d53d
Reviewed-on: https://review.whamcloud.com/34499
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: James Simmons <jsimmons@infradead.org>
Reviewed-by: Sonia Sharma <sharmaso@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>

index 6eb56d0..efe5603 100644 (file)
@@ -1936,7 +1936,7 @@ ksocknal_push(struct lnet_ni *ni, struct lnet_process_id id)
-                       if (i == 0) /* no match */
+                       if (i <= peer_off) /* no match */
                        rc = 0;